233
Language : PHP (Prevalence = Undetermined)
Language : Perl (Prevalence = Undetermined)
Language : Interpreted (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Files or Directories
Read Application Data
The injected code could access restricted data / files.
Access Control Bypass Protection Mechanism
In some cases, injectable code controls authentication; this
may lead to a remote vulnerability.
Access Control Gain Privileges or Assume Identity
Injected code can access resources that the attacker is
directly prevented from accessing.
Integrity
Confidentiality
Availability
Other
Execute Unauthorized Code or Commands
Code injection attacks can lead to loss of data integrity
in nearly all cases as the control-plane data injected is
always incidental to data recall or writing. Additionally,
code injection can often result in the execution of arbitrary
code.
Non-Repudiation Hide Activities
Often the actions performed by injected control code are
unlogged.
Potential Mitigations
Phase: Implementation
Strategy = Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use
a list of acceptable inputs that strictly conform to specifications. Reject any input that does not
strictly conform to specifications, or transform it into something that does. When performing
input validation, consider all potentially relevant properties, including length, type of input, the
full range of acceptable values, missing or extra inputs, syntax, consistency across related
fields, and conformance to business rules. As an example of business rule logic, "boat" may be
syntactically valid because it only contains alphanumeric characters, but it is not valid if the input
is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for
malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if
the code's environment changes. This can give attackers enough room to bypass the intended
validation. However, denylists can be useful for detecting potential attacks or determining which
inputs are so malformed that they should be rejected outright.
Phase: Implementation
Strategy = Output Encoding
Perform proper output validation and escaping to neutralize all code syntax from data written to
code files.
Demonstrative Examples
Example 1:
This example attempts to write user messages to a message file and allow users to view them.
CWE Version 4.14
CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
CWE-96: Improper Neutralization of Directives
in Statically Saved Code ('Static Code Injection') 234
Example Language: PHP (Bad)
$MessageFile = "messages.out";
if ($_GET["action"] == "NewMessage") {
$name = $_GET["name"];
$message = $_GET["message"];
$handle = fopen($MessageFile, "a+");
fwrite($handle, "<b>$name</b> says '$message'<hr>\n");
fclose($handle);
echo "Message Saved!<p>\n";
}
else if ($_GET["action"] == "ViewMessages") {
include($MessageFile);
}
While the programmer intends for the MessageFile to only include data, an attacker can provide a
message such as:
Example Language: (Attack)
name=h4x0r
message=%3C?php%20system(%22/bin/ls%20-l%22);?%3E
which will decode to the following:
Example Language: (Attack)
<?php system("/bin/ls -l");?>
The programmer thought they were just including the contents of a regular data file, but PHP
parsed it and executed the code. Now, this code is executed any time people view messages.
Notice that XSS (CWE-79) is also possible in this situation.
Observed Examples
Reference Description
CVE-2002-0495 Perl code directly injected into CGI library file from parameters to another CGI
program.
https://www.cve.org/CVERecord?id=CVE-2002-0495
CVE-2005-1876 Direct PHP code injection into supporting template file.
https://www.cve.org/CVERecord?id=CVE-2005-1876
CVE-2005-1894 Direct code injection into PHP script that can be accessed by attacker.
https://www.cve.org/CVERecord?id=CVE-2005-1894
CVE-2003-0395 PHP code from User-Agent HTTP header directly inserted into log file
implemented as PHP script.
https://www.cve.org/CVERecord?id=CVE-2003-0395
CVE-2007-6652 chain: execution after redirect allows non-administrator to perform static code
injection.
https://www.cve.org/CVERecord?id=CVE-2007-6652
Affected Resources
• File or Directory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
CWE Version 4.14
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page