CWE-184 (不完整的黑名单) — Vulnerability Class 169

169 vulnerabilities classified as CWE-184 (不完整的黑名单). AI Chinese analysis included.

CWE-184 represents a critical input validation weakness where an application relies on a blacklist of prohibited inputs that fails to cover all malicious variations. This approach is inherently fragile because attackers can easily bypass incomplete lists using encoding techniques, alternative syntax, or edge cases not anticipated by the developer. Exploitation typically occurs when an adversary submits crafted payloads that evade the restricted set, allowing unauthorized commands, code execution, or data injection to proceed unchecked. To mitigate this risk, developers should abandon blacklisting in favor of whitelisting, which permits only explicitly verified and safe inputs. Additionally, implementing robust input sanitization and normalization processes ensures that diverse attack vectors are neutralized before processing, thereby closing the gaps left by incomplete disallowed lists and significantly strengthening the application’s security posture against injection-based threats.

MITRE CWE Description

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Common Consequences (1)

Access Control Bypass Protection Mechanism

Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.

Mitigations (1)

Implementation Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as …

Examples (2)

The following code attempts to stop XSS attacks by removing all occurences of "script" in an input string.

public String removeScriptTags(String input, String mask) { return input.replaceAll("script", mask); }

Bad · Java

This example takes user input, passes it through an encoding scheme, then lists the contents of the user's home directory based on the user name.

sub GetUntrustedInput { return($ARGV[0]); } sub encode { my($str) = @_; $str =~ s/\&/\&amp;/gs; $str =~ s/\"/\&quot;/gs; $str =~ s/\'/\&apos;/gs; $str =~ s/\</\&lt;/gs; $str =~ s/\>/\&gt;/gs; return($str); } sub doit { my $uname = encode(GetUntrustedInput("username")); print "<b>Welcome, $uname!</b><p>\n"; system("cd /home/$uname; /bin/ls -l"); }

Bad · Perl

' pwd

Attack

CVE ID	Title	CVSS	Severity	Published
CVE-2022-32763	Lansweeper 跨站脚本漏洞 — lansweeper	5.4	-	2022-12-19
CVE-2022-35962	Crafted link in Zulip message can cause disclosure of credentials — zulip-mobile	8.0	High	2022-08-29
CVE-2022-38179	JetBrains Ktor framework 安全漏洞 — Ktor	4.7	Medium	2022-08-12
CVE-2021-31370	Junos OS: QFX5000 Series and EX4600 Series: Control traffic might be dropped if a high rate of specific multicast traffic is received — Junos OS	6.5	Medium	2021-10-19
CVE-2021-25737	Holes in EndpointSlice Validation Enable Host Network Hijack — Kubernetes	2.7	Low	2021-09-06
CVE-2021-25631	denylist of executable filename extensions possible to bypass under windows — LibreOffice	8.8	-	2021-05-03
CVE-2020-14372	grub2 安全漏洞 — grub2	8.2	-	2021-03-03
CVE-2021-1135	Cisco Data Center Network Manager REST API Vulnerabilities — Cisco Data Center Network Manager	4.6	Medium	2021-01-20
CVE-2021-1255	Cisco Data Center Network Manager REST API Vulnerabilities — Cisco Data Center Network Manager	4.6	Medium	2021-01-20
CVE-2021-1133	Cisco Data Center Network Manager REST API Vulnerabilities — Cisco Data Center Network Manager	4.6	Medium	2021-01-20
CVE-2020-3384	Cisco Data Center Network Manager Command Injection Vulnerability — Cisco Data Center Network Manager	8.2	High	2020-07-31
CVE-2020-5253	Privilege escalation in NetHack — NetHack	3.9	Low	2020-03-10
CVE-2018-16863	Red Hat Enterprise Linux 7 操作系统命令注入漏洞 — ghostscript	7.8	-	2018-12-03
CVE-2016-7076	Sudo 命令注入漏洞 — sudo	7.8	-	2018-05-29
CVE-2017-2602	CloudBees Jenkins 安全漏洞 — jenkins	4.3	-	2018-05-15
CVE-2017-15095	FasterXML Jackson-databind 代码问题漏洞 — jackson-databind	9.8	-	2018-02-06
CVE-2017-7525	FasterXML Jackson 代码问题漏洞 — jackson-databind	9.8	-	2018-02-06
CVE-2017-0909	private_address_check ruby gem 安全漏洞 — private_address_check ruby gem	9.8	-	2017-11-16
CVE-2017-7540	Foreman 安全漏洞 — rubygem-safemode	9.8	-	2017-07-21

Vulnerabilities classified as CWE-184 (不完整的黑名单) represent 169 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.