277
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-1272]Robert Auger. "HTTP Request Splitting". 2011 February 1. < http://
projects.webappsec.org/w/page/13246929/HTTP%20Request%20Splitting >.
CWE-114: Process Control
Weakness ID : 114
Structure : Simple
Abstraction : Class
Description
Executing commands or loading libraries from an untrusted source or in an untrusted environment
can cause an application to execute malicious commands (and payloads) on behalf of an attacker.
Extended Description
Process control vulnerabilities take two forms:
• An attacker can change the command that the program executes: the attacker explicitly
controls what the command is.
• An attacker can change the environment in which the command executes: the attacker
implicitly controls what the command means.
Process control vulnerabilities of the first type occur when either data enters the application from an
untrusted source and the data is used as part of a string representing a command that is executed
by the application. By executing the command, the application gives an attacker a privilege or
capability that the attacker would not otherwise have.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 73 External Control of File Name or Path 132
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Relevant to the view "Seven Pernicious Kingdoms" (CWE-700)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Execute Unauthorized Code or Commands
CWE Version 4.14
CWE-114: Process Control
CWE-114: Process Control