CWE-777: Regular Expression without Anchors

Extended Description

When performing tasks such as validating against a set of allowed inputs (allowlist), data is examined and possibly modified to ensure that it is well-formed and adheres to a list of safe values. If the regular expression is not anchored, malicious or malformed data may be included before or after any string matching the regular expression. The type of malicious data that is allowed will depend on the context of the application and which anchors are omitted from the regular expression.

Code Examples & CVEs

Demonstrative Examples

Consider a web application that supports multiple languages. It selects messages for an appropriate language by using the lang parameter.

The previous code attempts to match only alphanumeric values so that language values such as "english" and "french" are valid while also protecting against path traversal, CWE-22. However, the regular expression anchors are omitted, so any text containing at least one alphanumeric character will now pass the validation step. For example, the attack string below will match the regular expression.

BadPHP

$dir = "/home/cwe/languages";$lang = $_GET['lang'];if (preg_match("/[A-Za-z0-9]+/", $lang)) {include("$dir/$lang");}else {echo "You shall not pass!\n";}

This code uses a regular expression to validate an IP string prior to using it in a call to the "ping" command.

Since the regular expression does not have anchors (CWE-777), i.e. is unbounded without ^ or $ characters, then prepending a 0 or 0x to the beginning of the IP address will still result in a matched regex pattern. Since the ping command supports octal and hex prepended IP addresses, it will use the unexpectedly valid IP address (CWE-1389). For example, "0x63.63.63.63" would be considered equivalent to "99.63.63.63". As a result, the attacker could potentially ping systems that the attacker cannot reach directly.

BadPython

import subprocess 		  import re 		   		  def validate_ip_regex(ip: str): 		   		    ip_validator = re.compile(r"((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}") 		    if ip_validator.match(ip): 		     		      return ip 		     		    else: 		     		      raise ValueError("IP address does not match valid pattern.") 		     		   		   		  def run_ping_regex(ip: str): 		   		    validated = validate_ip_regex(ip) 		    # The ping command treats zero-prepended IP addresses as octal 		    result = subprocess.call(["ping", validated]) 		    print(result)

Observed CVE Examples (1)

CVE-2022-30034

Chain: Web UI for a Python RPC framework does not use regex anchors to validate user login emails (CWE-777), potentially allowing bypass of OAuth (CWE-1390).

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-777 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-777, Regular Expression without Anchors, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Address Regular Expression without Anchors during Implementation

MITRE associates mitigation with Implementation; recorded impacts include Bypass Protection Mechanism; observed examples include CVE-2022-30034. Use these source-defined anchors to turn CWE-777 into implementation, review, and verification checks for the affected component.

CWE-777: Regular Expression without Anchors — MITRE CWE

Triage CWE-777 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-777, Regular Expression without Anchors, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-777

Apply MITRE's full root-cause mapping guidance when using CWE-777, Regular Expression without Anchors. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-777 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-777, Regular Expression without Anchors. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-777: Regular Expression without Anchors?+

CWE-777: Regular Expression without Anchors is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through. When performing tasks such as validating against a set of allowed inputs (allowlist), data is examined and possibly modified to ensure that it is well-formed and adheres to a list of safe values. If the regular expression is not anchored, malicious or malformed data may be included before or after any string matching the regular expression. The type of malicious data that is allowed will depend on the context of the application and which anchors are omitted from the regular expression.

What are the security consequences of Regular Expression without Anchors?+

If exploited, CWE-777 (Regular Expression without Anchors) it can compromise Availability, Confidentiality and Access Control, leading to outcomes such as Bypass Protection Mechanism.

How do you prevent or mitigate Regular Expression without Anchors?+

Recommended mitigations for CWE-777 include: Be sure to understand both what will be matched and what will not be matched by a regular expression. Anchoring the ends of the expression will allow the programmer to define an allowlist strictly limited to what is matched by the text in the regular expression. If you are using a package that only matches one line by default, ensure that you can match multi-line inputs if necessary.

Which programming languages are affected by Regular Expression without Anchors?+

CWE-777 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Regular Expression without Anchors?+

MITRE documents real CVEs mapped to CWE-777, including CVE-2022-30034. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-777 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-777: Regular Expression without Anchors

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Phase

Description

Detection Methods