CWE-99 Resource Injection

Coverage: 3 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 3 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged resource identifiers (filenames, URLs, bucket keys, template names) being constructed from untrusted input, allowing an attacker to select unexpected resources.

Why it matters

Attackers can access unexpected resources or files.

• Sensitive file access if resource selection maps to filesystem paths.
• SSRF or data exfiltration if resource selection controls outbound fetches.
• Authorization bypass if users can select resources they shouldn't access.

Safer examples

1) Use allowlists for resource selection

const allowed = { summary: "/reports/summary.json", invoice: "/reports/invoice.csv" };
const key = req.query.type in allowed ? req.query.type : "summary";
const path = allowed[key];

2) Enforce base directories / trusted hosts

For paths: normalize and enforce base directories. For URLs: allowlist hosts (see CWE-23/36 and CWE-918).

3) Add authorization at the resource level

Even if a resource exists, verify the requester is allowed to access it.

How SiteShadow detects it (high level)

• Detects resource/path/url construction from request-derived values.
• Flags when resource selectors are not allowlisted or validated, especially near file/HTTP sinks.

References

• CWE-99: https://cwe.mitre.org/data/definitions/99.html

---

← Back to Vulnerability Library