Supported Weaknesses

Application CWE Coverage

CWE	Weakness	Coverage Highlights
CWE-20	Improper Input Validation	Identifies missing validation, untrusted deserialisation, and unsafe type coercion before data reaches sensitive sinks.
CWE-22	Path Traversal	Tracks file-system access from HTTP handlers, CLIs, and background jobs to prevent arbitrary file reads and writes.
CWE-77	Command Injection	Detects unsanitised command construction in shell runners, build tooling, and deployment scripts.
CWE-78	OS Command Injection	Finds user-controlled data reaching operating system calls (for example exec, Runtime.exec, subprocess, ProcessBuilder).
CWE-79	Cross-Site Scripting (XSS)	Covers reflected and stored variants across templating engines and SPA frameworks.
CWE-89	SQL Injection	Supports ORM and raw-query patterns in Go, Java, JavaScript/TypeScript, Ruby, PHP, Python, and Scala.
CWE-94	Code Injection	Flags dynamic evaluation, template injection, and remote code download scenarios.
CWE-269	Improper Privilege Management	Verifies authorisation guards, middleware ordering, and access control annotations.
CWE-287	Improper Authentication	Detects missing authentication, weak session handling, and uncontrolled login backdoors.
CWE-352	Cross-Site Request Forgery	Validates CSRF mitigations for web, API, and mobile backend endpoints.
CWE-434	Unrestricted File Upload	Ensures upload handlers enforce type, size, and storage-location controls.
CWE-502	Deserialisation of Untrusted Data	Flags unsafe use of native, JSON, XML, and binary deserialisers across languages.
CWE-798	Hard-coded Credentials	Surfaces embedded secrets in application code alongside Secrets & Data Guardrails detections.
CWE-918	Server-Side Request Forgery	Detects pivot chains that reach cloud metadata services, internal control planes, or partner APIs.

Compound Attack Paths

Beyond single CWE detections, Nullify maintains benchmark families for chained exploits:

• Cloud-to-code pivots – Scenarios such as cloud_to_code/internet_exposed_sql_injection_critical confirm Nullify links IaC misconfigurations to vulnerable application routes.

• Network reachability graph – Cases in network_reachability/* validate AWS VPC, security group, NACL, and transit-gateway analysis used in Cloud Audit findings.

• Container and build hardening – containers/* and Containerfile/* repositories keep coverage current for Dockerfile misuse, image provenance, and privilege escalation vectors.

• OpenAPI-aware pentesting – openapi_reversing/* and pentest/* test cases verify Nullify can import specifications, explore auth flows, and record reproduction evidence for Bug Hunter and Pentester engagements.