151
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Command injection
OWASP Top Ten 2007 A2 CWE More Specific Injection Flaws
OWASP Top Ten 2004 A1 CWE More Specific Unvalidated Input
OWASP Top Ten 2004 A6 CWE More Specific Injection Flaws
Software Fault Patterns SFP24 Tainted input to command
SEI CERT Perl Coding
Standard
IDS34-
PL
CWE More Specific Do not pass untrusted, unsanitized data
to a command interpreter
Related Attack Patterns
CAPEC-ID Attack Pattern Name
15 Command Delimiters
40 Manipulating Writeable Terminal Devices
43 Exploiting Multiple Input Interpretation Layers
75 Manipulating Writeable Configuration Files
76 Manipulating Web Input to File System Calls
136 LDAP Injection
183 IMAP/SMTP Command Injection
248 Command Injection
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-140]Greg Hoglund and Gary McGraw. "Exploiting Software: How to Break Code". 2004
February 7. Addison-Wesley. < https://www.amazon.com/Exploiting-Software-How-Break-Code/
dp/0201786958 >.2023-04-07.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-1287]MITRE. "Supplemental Details - 2022 CWE Top 25". 2022 June 8. < https://
cwe.mitre.org/top25/archive/2022/2022_cwe_top25_supplemental.html#problematicMappingDetails
>.
CWE-78: Improper Neutralization of Special Elements used in an OS Command
('OS Command Injection')
Weakness ID : 78
Structure : Simple
Abstraction : Base
Description
The product constructs all or part of an OS command using externally-influenced input from an
upstream component, but it does not neutralize or incorrectly neutralizes special elements that
could modify the intended OS command when it is sent to a downstream component.
Extended Description
This could allow attackers to execute unexpected, dangerous commands directly on the operating
system. This weakness can lead to a vulnerability in environments in which the attacker does
not have direct access to the operating system, such as in web applications. Alternately, if the
weakness occurs in a privileged program, it could allow the attacker to specify commands that
CWE Version 4.14
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command
Injection')
CWE-78: Improper Neutralization of Special Elements
used in an OS Command ('OS Command Injection') 152
normally would not be accessible, or to call alternate commands with privileges that the attacker
does not have. The problem is exacerbated if the compromised process does not follow the
principle of least privilege, because the attacker-controlled commands may run with special system
privileges that increases the amount of damage.
There are at least two subtypes of OS command injection:
• The application intends to execute a single, fixed program that is under its own control. It
intends to use externally-supplied inputs as arguments to that program. For example, the
program might use system("nslookup [HOSTNAME]") to run nslookup and allow the user to
supply a HOSTNAME, which is used as an argument. Attackers cannot prevent nslookup
from executing. However, if the program does not remove command separators from the
HOSTNAME argument, attackers could place the separators into the arguments, which allows
them to execute their own program after nslookup has finished executing.
• The application accepts an input that it uses to fully select which program to run, as well
as which commands to use. The application simply redirects this entire command to the
operating system. For example, the program might use "exec([COMMAND])" to execute the
[COMMAND] that was supplied by the user. If the COMMAND is under attacker control, then
the attacker can execute arbitrary commands or programs. If the command is being executed
using functions like exec() and CreateProcess(), the attacker might not be able to combine
multiple commands together in the same line.
From a weakness standpoint, these variants represent distinct programmer errors. In the first
variant, the programmer clearly intends that input from untrusted parties will be part of the
arguments in the command to be executed. In the second variant, the programmer does not intend
for the command to be accessible to any untrusted party, but the programmer probably has not
accounted for alternate ways in which malicious attackers can provide input.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 77 Improper Neutralization of Special Elements used in a
Command ('Command Injection')