CWE-102: Struts: Duplicate Validation Forms
Official CWE-102 CWE context with Glexia analysis, remediation guidance, related CVEs, and ATT&CK context.
Glexia's Take
CWE-102: Struts: Duplicate Validation Forms
Struts: Duplicate Validation Forms represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Executive Impact
- Integrity: Unexpected State
Developer Pattern
CWE-102 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.
Confidence
high confidence from CWE-102, 4.20.
Official CWE Definition
CWE-102: Struts: Duplicate Validation Forms
The product uses multiple validation forms with the same name, which might cause the Struts Validator to validate a form that the programmer does not expect.
If two validation forms have the same name, the Struts Validator arbitrarily chooses one of the forms to use for input validation and discards the other. This decision might not correspond to the programmer's expectations, possibly leading to resultant weaknesses. Moreover, it indicates that the validation logic is not up-to-date, and can indicate that other, more subtle validation errors are present.
Developer And Remediation Guidance
How teams prevent and detect this weakness
Causes
- These two Struts validation forms have the same name. It is not certain which form will be used by Struts. It is critically important that validation logic be maintained and kept in sync with the rest of the product.
Remediation
- Implementation: The DTD or schema validation will not catch the duplicate occurrence of the same form name. To find the issue in the implementation, manual checks or automated static analysis could be applied to the xml configuration files.
Detection
- Code review
- SAST
- DAST
- Focused regression tests
Mappings
Related CVEs, CWEs, and ATT&CK context
Related CWEs
ATT&CK Relevance
ATT&CK relevance is shown only when reviewed or responsibly inferred.