Weaknesses of type CWE-134

144 results

Uso de string de formato controlada externamente

Ocorre quando a aplicação passa uma string vinda de entrada do usuário diretamente como argumento de formato em funções como printf(), sprintf() ou logging. Um atacante pode injetar especificadores de formato (%x, %s, %n) para ler ou escrever dados arbitrários na memória, comprometendo confidencialidade e integridade.

Example

Um programa web recebe um parâmetro 'nome' do usuário e faz `printf(nome)` em vez de `printf("%s", nome)`. Um atacante envia 'nome=%x.%x.%x' e consegue vazar dados da pilha; ou usa '%n' para sobrescrever endereços de memória.

How to mitigate

Nunca passe entrada do usuário diretamente como string de formato. Use sempre um formato fixo: `printf("%s", entrada_usuario)` em C, ou equivalente em outras linguagens. Em logs, sanitize ou use APIs de logging estruturado que não interpretam strings de formato.

CVE-2011-10029HIGHSolar FTP Server <= 2.1.1 Malformed USER Denial of ServiceEPSS 0.7%CVE-2015-10088MEDIUMayttm proxy.c http_connect format stringEPSS 0.7%CVE-2024-12805HIGHA post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads tEPSS 0.7%CVE-2023-2186HIGHOn Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message iEPSS 0.7%CVE-2024-45324HIGHA use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, veEPSS 0.7%CVE-2023-45583MEDIUMA use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions,EPSS 0.7%CVE-2022-24051HIGHMariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate priviEPSS 0.7%CVE-2024-50397HIGHQTS, QuTS heroEPSS 0.7%CVE-2023-6399MEDIUMA format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4EPSS 0.6%CVE-2023-41349HIGHASUS RT-AX88U - externally-controlled format stringEPSS 0.6%CVE-2023-53966CRITICALSOUND4 LinkAndShare Transmitter 1.1.2 Format String Stack Buffer OverflowEPSS 0.6%CVE-2024-50396HIGHQTS, QuTS heroEPSS 0.6%CVE-2024-45330MEDIUMA use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to EPSS 0.6%CVE-2023-24590HIGH A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instaEPSS 0.6%CVE-2022-26393MEDIUMFormat String vulnerabilityEPSS 0.6%CVE-2026-12174HIGHD-Link DCS-935L HTTP rhea snprintf format stringEPSS 0.6%CVE-2022-26392LOWFormat String vulnerabilityEPSS 0.6%CVE-2024-50399LOWQTS, QuTS heroEPSS 0.6%CVE-2024-50401LOWQTS, QuTS heroEPSS 0.6%CVE-2024-50398LOWQTS, QuTS heroEPSS 0.6%