CWE-450 (UI输入的多重解释) — Vulnerability Class 2

CWE-450 represents a logic flaw where an application ambiguously interprets user interface input, often defaulting to a less secure interpretation without explicit user confirmation. Attackers typically exploit this by crafting inputs that trigger unintended behaviors, such as bypassing authentication checks or executing unauthorized commands, by leveraging the system’s assumption of intent. For instance, a web form might accept both numeric and string values for a field, allowing an attacker to inject malicious code if the backend processes the string as executable logic. To mitigate this risk, developers must enforce strict input validation and type checking, ensuring that all user-supplied data is explicitly defined and sanitized before processing. Implementing clear, unambiguous prompts and using allowlists for acceptable inputs further reduces the attack surface, preventing the application from making dangerous assumptions about user intent.