CVE-2023-20057

Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.

Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.

Secure SDLC practices directly require complete input filtering and validation to prevent this class of weakness.

Logging supports detection of injection attempts but does not prevent the weakness.

Monitoring activities can identify active injection attacks after they occur.

A.8.25 mandates secure SDLC practices including secure coding guidelines, security requirements, checkpoints, testing (scans/penetration), and developer training that reach many but not all filtering defects before downstream use; a bounded remainder (e.g. incomplete coverage of obscure element variants, second-order flows, or non-software system boundaries) can still be exploited.

A.8.26 requires identifying and specifying requirements (incl. resilience against SQL injections, input validation, output controls, and related protections), which can lead to preventing incomplete filtering of special elements, but only reaches a minority slice since it is a requirements-gathering process whose effect depends on downstream implementation by other controls.

A.8.27 mandates security-by-design principles including data validation/sanitization, distrust-external-input, secure architecture reviews against attack patterns, and defense-in-depth; this reaches some but not most instances of incomplete special-element filtering (a code-level neutralization defect), with the bulk left to implementation rigor in A.8.28 or specific testing in A.8.29.

Secure coding standards require complete sanitization of special elements before downstream processing.