CWE-99 (对资源描述符的控制不恰当(资源注入)) — Vulnerability Class 72

CWE-99 represents a critical input validation weakness where applications fail to restrict user-supplied data before using it as an identifier for external resources. Attackers typically exploit this vulnerability by injecting malicious payloads, such as directory traversal sequences or remote resource references, into input fields. This allows them to bypass intended access controls, potentially reading sensitive local files, accessing restricted network services, or executing arbitrary code on the server. To mitigate this risk, developers must implement strict allow-listing strategies for all resource identifiers, ensuring only predefined, safe values are accepted. Additionally, employing robust input sanitization techniques and validating data types can prevent attackers from manipulating resource paths. By rigorously controlling how user input interacts with system resources, organizations can effectively neutralize injection attacks and maintain the integrity and confidentiality of their applications.