detecting-format-string

waiwai24's avatarfrom waiwai24

Detects format string vulnerabilities by identifying unsafe printf family function calls with user-controlled format strings. Use when analyzing logging, error handling, or investigating memory disclosure via format strings.

⭐0stars🔀0forks📁View on GitHub🕐Updated Dec 26, 2025
[Security Operations]

When & Why to Use This Skill

This Claude skill is a specialized security tool designed to detect format string vulnerabilities in C/C++ applications. It automates the identification of unsafe 'printf' family function calls—including fprintf, sprintf, and syslog—where user-controlled input is used as a format string. By tracing data flow from source to sink and analyzing format specifiers like %n or %s, the skill helps security auditors and developers prevent critical memory disclosure and arbitrary memory write exploits, providing a comprehensive report with severity levels and mitigation strategies.

Use Cases

  • Automated Security Auditing: Scan legacy codebases or new pull requests to identify instances where user input is directly passed to logging or error-handling functions without proper sanitization.
  • Vulnerability Research & Pentesting: Use the skill to investigate potential memory disclosure bugs by tracing how external data influences format strings in sensitive system calls.
  • Secure Development Lifecycle (SDL): Integrate into the code review process to ensure all format strings are constant literals, effectively neutralizing one of the most common classes of memory corruption vulnerabilities.
  • Incident Response: Quickly assess the exploitability of a reported bug by determining if an attacker can control format specifiers to read or write to arbitrary memory locations.
namedetecting-format-string
descriptionDetects format string vulnerabilities by identifying unsafe printf family function calls with user-controlled format strings. Use when analyzing logging, error handling, or investigating memory disclosure via format strings.

Format String Detection

Detection Workflow

  1. Identify printf calls: Find printf, fprintf, sprintf, snprintf, syslog functions
  2. Trace format string source: Use xrefs_to to trace format string to user input
  3. Check format specifier: Verify if format string is constant literal or user-controlled
  4. Assess exploitability: Can attacker control format string? Can they read/write memory?

Key Patterns

  • printf(user_string) - user input as format string
  • fprintf(file, user_input) - direct use of user input
  • Memory read via %s, %x format specifiers
  • Memory write via %n format specifier

Output Format

Report with: id, type, severity, confidence, location, sink, source, format string, format specifier status, exploitability, attack vector, evidence, mitigation.

Severity Guidelines

  • CRITICAL: Format string with %n and user control
  • HIGH: Format string with user control (read-only)
  • MEDIUM: Format string with limited user control
  • LOW: Format string with constant format string

See Also

  • patterns.md - Detailed detection patterns and exploitation scenarios
  • examples.md - Example analysis cases and code samples
  • references.md - CWE references and mitigation strategies