CWE-187: Partial String Comparison

Variant

The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

For example, an attacker might succeed in authentication by providing a small password that matches the associated portion of the larger, correct password.

Consequences

Integrity, Access Control: Alter Execution Logic, Bypass Protection Mechanism

How to prevent it

Testing: Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.

Recent advisories

GHSA-376h-93r7-7g6f — Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
GHSA-hg3h-g7xc-f7vp — view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
GHSA-h2jq-g4cq-5ppq — Rack::Static prefix matching can expose unintended files under the static root
GHSA-v23v-6jw2-98fq — Authz zero length regression

All advisories for CWE-187

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor