149
The code above allows an attacker to execute arbitrary commands with the elevated privilege of
the application by modifying the system property APPHOME to point to a different path containing
a malicious version of INITCMD. Because the program does not validate the value read from the
environment, if an attacker can control the value of the system property APPHOME, then they can
fool the application into running malicious code and take control of the system.
Example 4:
The following code is a wrapper around the UNIX command cat which prints the contents of a file to
standard out. It is also injectable:
Example Language: C (Bad)
#include <stdio.h>
#include <unistd.h>
int main(int argc, char **argv) {
char cat[] = "cat ";
char *command;
size_t commandLength;
commandLength = strlen(cat) + strlen(argv[1]) + 1;
command = (char *) malloc(commandLength);
strncpy(command, cat, commandLength);
strncat(command, argv[1], (commandLength - strlen(cat)) );
system(command);
return (0);
}
Used normally, the output is simply the contents of the file requested:
Example Language: (Informative)
$ ./catWrapper Story.txt
When last we left our heroes...
However, if we add a semicolon and another command to the end of this line, the command is
executed by catWrapper with no complaint:
Example Language: (Attack)
$ ./catWrapper Story.txt; ls
When last we left our heroes...
Story.txt
SensitiveFile.txt
PrivateData.db
a.out*
If catWrapper had been set to have a higher privilege level than the standard user, arbitrary
commands could be executed with that higher privilege.
Observed Examples
Reference Description
CVE-2022-36069 Python-based dependency management tool avoids OS command injection
when generating Git commands but allows injection of optional arguments with
input beginning with a dash, potentially allowing for code execution.
https://www.cve.org/CVERecord?id=CVE-2022-36069
CVE-1999-0067 Canonical example of OS command injection. CGI program does not
neutralize "|" metacharacter when invoking a phonebook program.
https://www.cve.org/CVERecord?id=CVE-1999-0067
CVE-2020-9054 Chain: improper input validation (CWE-20) in username parameter, leading to
OS command injection (CWE-78), as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-9054
CWE Version 4.14
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-77: Improper Neutralization of Special
Elements used in a Command ('Command Injection') 150
Reference Description
CVE-2022-1509 injection of sed script syntax ("sed injection")
https://www.cve.org/CVERecord?id=CVE-2022-1509
CVE-2021-41282 injection of sed script syntax ("sed injection")
https://www.cve.org/CVERecord?id=CVE-2021-41282
CVE-2019-13398 injection of sed script syntax ("sed injection")
https://www.cve.org/CVERecord?id=CVE-2019-13398
CVE-2019-12921 image program allows injection of commands in "Magick Vector Graphics
(MVG)" language.
https://www.cve.org/CVERecord?id=CVE-2019-12921
CVE-2020-11698 anti-spam product allows injection of SNMP commands into confiuration file
https://www.cve.org/CVERecord?id=CVE-2020-11698
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 713 OWASP Top Ten 2007 Category A2 - Injection Flaws 629 2330
MemberOf 722 OWASP Top Ten 2004 Category A1 - Unvalidated Input 711 2334
MemberOf 727 OWASP Top Ten 2004 Category A6 - Injection Flaws 711 2337
MemberOf 929 OWASP Top Ten 2013 Category A1 - Injection 928 2389
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1005 7PK - Input Validation and Representation 700 2421
MemberOf 1027 OWASP Top Ten 2017 Category A1 - Injection 1026 2435
MemberOf 1179 SEI CERT Perl Coding Standard - Guidelines 01. Input
Validation and Data Sanitization (IDS)
1178 2465
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1337 Weaknesses in the 2021 CWE Top 25 Most Dangerous
Software Weaknesses
1337 2589
MemberOf 1340 CISQ Data Protection Measures 1340 2590
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous
Software Weaknesses
1387 2597
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
MemberOf 1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous
Software Weaknesses
1425 2600
Notes
Terminology
The "command injection" phrase carries different meanings to different people. For some people,
it refers to any type of attack that can allow the attacker to execute commands of their own
choosing, regardless of how those commands are inserted. The command injection could thus
be resultant from another weakness. This usage also includes cases in which the functionality
allows the user to specify an entire command, which is then executed; within CWE, this situation
might be better regarded as an authorization problem (since an attacker should not be able
to specify arbitrary commands.) Another common usage, which includes CWE-77 and its
descendants, involves cases in which the attacker injects separators into the command being
constructed.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Command Injection
CWE Version 4.14
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command
Injection')
CWE-78: Improper Neutralization of Special Elements
used in an OS Command ('OS Command Injection')