145
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 137 Data Neutralization Issues 2311
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Alternate Terms
Shell injection :
Shell metacharacters :
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Non-Repudiation
Execute Unauthorized Code or Commands
DoS: Crash, Exit, or Restart
Read Files or Directories
Modify Files or Directories
Read Application Data
Modify Application Data
Hide Activities
Attackers could execute unauthorized commands,
which could then be used to disable the product, or
read and modify data for which the attacker does not
have permissions to access directly. Since the targeted
application is directly executing the commands instead of
the attacker, any malicious activities may appear to come
from the application or the application's owner.
Detection Methods
Automated Static Analysis
This weakness can often be detected using automated static analysis tools. Many modern tools
use data flow analysis or constraint-based techniques to minimize the number of false positives.
Automated static analysis might not be able to recognize when proper input validation is being
performed, leading to false positives - i.e., warnings that do not have any security consequences
or require any code changes. Automated static analysis might not be able to detect the usage of
custom API functions or third-party libraries that indirectly invoke OS commands, leading to false
negatives - especially if the API/library code is not available for analysis.
Automated Dynamic Analysis
This weakness can be detected using dynamic tools and techniques that interact with the product
using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness
testing, and fault injection. The product's operation may slow down, but it should not become
unstable, crash, or generate incorrect results.
CWE Version 4.14
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command
Injection')
CWE-78: Improper Neutralization of Special Elements
used in an OS Command ('OS Command Injection') 154
Effectiveness = Moderate
Manual Static Analysis
Since this weakness does not typically appear frequently within a single software package,
manual white box techniques may be able to provide sufficient code coverage and reduction
of false positives if all potentially-vulnerable operations can be assessed within limited time
constraints.
Effectiveness = High
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary
Weakness Analysis - including disassembler + source code weakness analysis
Effectiveness = High
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Web Application Scanner Web Services Scanner Database Scanners
Effectiveness = SOAR Partial
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Fuzz Tester Framework-based Fuzzer
Effectiveness = SOAR Partial
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Manual Source Code Review (not inspections) Cost effective for partial coverage: Focused
Manual Spotcheck - Focused manual analysis of source
Effectiveness = High
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer
Effectiveness = High
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE
1028 standard) (can apply to requirements, design, source code, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired
functionality.
Phase: Architecture and Design
Phase: Operation
Strategy = Sandbox or Jail
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between
the process and the operating system. This may effectively restrict which files can be accessed
CWE Version 4.14
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command
Injection')
CWE-78: Improper Neutralization of Special Elements
used in an OS Command ('OS Command Injection')