159
Example Language: Perl (Bad)
use CGI qw(:standard);
$name = param('name');
$nslookup = "/path/to/nslookup";
print header;
if (open($fh, "$nslookup $name|")) {
while (<$fh>) {
print escapeHTML($_);
print "<br>\n";
}
close($fh);
}
Suppose an attacker provides a domain name like this:
Example Language: (Attack)
cwe.mitre.org%20%3B%20/bin/ls%20-l
The "%3B" sequence decodes to the ";" character, and the %20 decodes to a space. The open()
statement would then process a string like this:
Example Language: (Result)
/path/to/nslookup cwe.mitre.org ; /bin/ls -l
As a result, the attacker executes the "/bin/ls -l" command and gets a list of all the files in the
program's working directory. The input could be replaced with much more dangerous commands,
such as installing a malicious program on the server.
Example 4:
The example below reads the name of a shell script to execute from the system properties. It is
subject to the second variant of OS command injection.
Example Language: Java (Bad)
String script = System.getProperty("SCRIPTNAME");
if (script != null)
System.exec(script);
If an attacker has control over this property, then they could modify the property to point to a
dangerous program.
Example 5:
In the example below, a method is used to transform geographic coordinates from latitude and
longitude format to UTM format. The method gets the input coordinates from a user through
a HTTP request and executes a program local to the application server that performs the
transformation. The method passes the latitude and longitude coordinates as a command-line
option to the external program and will perform some processing to retrieve the results of the
transformation and return the resulting UTM coordinates.
Example Language: Java (Bad)
public String coordinateTransformLatLonToUTM(String coordinates)
{
String utmCoords = null;
try {
String latlonCoords = coordinates;
Runtime rt = Runtime.getRuntime();
Process exec = rt.exec("cmd.exe /C latlon2utm.exe -" + latlonCoords);
// process results of coordinate transform
CWE Version 4.14
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command
Injection')
CWE-78: Improper Neutralization of Special Elements
used in an OS Command ('OS Command Injection') 160
// ...
}
catch(Exception e) {...}
return utmCoords;
}
However, the method does not verify that the contents of the coordinates input parameter includes
only correctly-formatted latitude and longitude coordinates. If the input coordinates were not
validated prior to the call to this method, a malicious user could execute another program local to
the application server by appending '&' followed by the command for another program to the end of
the coordinate string. The '&' instructs the Windows operating system to execute another program.
Example 6:
The following code is from an administrative web application designed to allow users to kick
off a backup of an Oracle database using a batch-file wrapper around the rman utility and then
run a cleanup.bat script to delete some temporary files. The script rmanDB.bat accepts a single
command line parameter, which specifies what type of backup to perform. Because access to the
database is restricted, the application runs the backup as a privileged user.
Example Language: Java (Bad)
...
String btype = request.getParameter("backuptype");
String cmd = new String("cmd.exe /K \"
c:\\util\\rmanDB.bat "
+btype+
"&&c:\\utl\\cleanup.bat\"")
System.Runtime.getRuntime().exec(cmd);
...
The problem here is that the program does not do any validation on the backuptype parameter
read from the user. Typically the Runtime.exec() function will not execute multiple commands,
but in this case the program first runs the cmd.exe shell in order to run multiple commands with a
single call to Runtime.exec(). Once the shell is invoked, it will happily execute multiple commands
separated by two ampersands. If an attacker passes a string of the form "& del c:\\dbms\\*.*", then
the application will execute this command along with the others specified by the program. Because
of the nature of the application, it runs with the privileges necessary to interact with the database,
which means whatever command the attacker injects will run with those privileges as well.
Observed Examples
Reference Description
CVE-2020-10987 OS command injection in Wi-Fi router, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-10987
CVE-2020-10221 Template functionality in network configuration management tool allows OS
command injection, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-10221
CVE-2020-9054 Chain: improper input validation (CWE-20) in username parameter, leading to
OS command injection (CWE-78), as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-9054
CVE-1999-0067 Canonical example of OS command injection. CGI program does not
neutralize "|" metacharacter when invoking a phonebook program.
https://www.cve.org/CVERecord?id=CVE-1999-0067
CVE-2001-1246 Language interpreter's mail function accepts another argument that is
concatenated to a string used in a dangerous popen() call. Since there is no
neutralization of this argument, both OS Command Injection (CWE-78) and
Argument Injection (CWE-88) are possible.
https://www.cve.org/CVERecord?id=CVE-2001-1246
CVE-2002-0061 Web server allows command execution using "|" (pipe) character.
CWE Version 4.14
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command
Injection')
CWE-78: Improper Neutralization of Special Elements
used in an OS Command ('OS Command Injection')