目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-176 Unicode编码处理不恰当 类漏洞列表 33

CWE-176 Unicode编码处理不恰当 类弱点 33 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-176 属于输入验证缺陷，指软件未能正确处理包含 Unicode 编码的输入数据。攻击者常利用编码混淆或非法字符序列绕过安全过滤机制，从而触发缓冲区溢出、注入攻击或逻辑错误。开发者应实施严格的输入验证，确保对 Unicode 数据进行标准化处理，并采用白名单机制限制可接受的字符集，以消除编码解析不一致带来的安全隐患。

MITRE CWE 官方描述
CWE：CWE-176 不当处理 Unicode 编码 英文：当输入包含 Unicode 编码时，产品未能正确处理。
常见影响 (1)
Integrity Unexpected State
缓解措施 (3)
Architecture and Design Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Implementation Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
代码示例 (1)
Windows provides the MultiByteToWideChar(), WideCharToMultiByte(), UnicodeToBytes(), and BytesToUnicode() functions to convert between arbitrary multibyte (usually ANSI) character strings and Unicode (wide character) strings. The size arguments to these functions are specified in different units, (one in bytes, the other in characters) making their use prone to error.
void getUserInfo(char *username, struct _USER_INFO_2 info){ WCHAR unicodeUser[UNLEN+1]; MultiByteToWideChar(CP_ACP, 0, username, -1, unicodeUser, sizeof(unicodeUser)); NetUserGetInfo(NULL, unicodeUser, 2, (LPBYTE *)&info); }
Bad · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2023-39213 Zoom Client 注入漏洞 — Zoom Desktop Client for Windows and Zoom VDI Client 9.6 Critical 2023-08-08
CVE-2022-29812 JetBrains IntelliJ IDEA 安全漏洞 — IntelliJ IDEA 2.3 Low 2022-04-28
CVE-2020-8929 Tink 安全漏洞 — Tink 5.3 Medium 2020-10-19

CWE-176（Unicode编码处理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 33 条 CVE 漏洞。