CWE-99: Improper Control of Resource Identifiers ('Resource Injection')

ClassDraftExploit Likelihood: High

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

View on MITRE
Back to CWE Lookup

Extended Description

A resource injection issue occurs when the following two conditions are met: An attacker can specify the identifier used to access a system resource. For example, an attacker might be able to specify part of the name of a file to be opened or a port number to be used. By specifying the resource, the attacker gains a capability that would not otherwise be permitted. For example, the program may give the attacker the ability to overwrite the specified file, run with a configuration controlled by the attacker, or transmit sensitive information to a third-party server. This may enable an attacker to access or modify otherwise protected system resources.

Technical Details

Structure
Simple

Applicable To

Languages
Not Language-Specific
Platforms

Learn More