224
of functions or variables are involved. Unfortunately, in this case, the attacker can provide other
values in the action parameter, such as:
Example Language: (Attack)
add_key(",","); system("/bin/ls");
This would produce the following string in handleConfigAction():
Example Language: (Result)
config_file_add_key(",","); system("/bin/ls");
Any arbitrary Perl code could be added after the attacker has "closed off" the construction of the
original function call, in order to prevent parsing errors from causing the malicious eval() to fail
before the attacker's payload is activated. This particular manipulation would fail after the system()
call, because the "_key(\$fname, \$key, \$val)" portion of the string would cause an error, but this is
irrelevant to the attack because the payload has already been activated.
Example 3:
This simple script asks a user to supply a list of numbers as input and adds them together.
Example Language: Python (Bad)
def main():
sum = 0
numbers = eval(input("Enter a space-separated list of numbers: "))
for num in numbers:
sum = sum + num
print(f"Sum of {numbers} = {sum}")
main()
The eval() function can take the user-supplied list and convert it into a Python list object, therefore
allowing the programmer to use list comprehension methods to work with the data. However, if
code is supplied to the eval() function, it will execute that code. For example, a malicious user could
supply the following string:
Example Language: (Attack)
__import__('subprocess').getoutput('rm -r *')
This would delete all the files in the current directory. For this reason, it is not recommended to use
eval() with untrusted input.
A way to accomplish this without the use of eval() is to apply an integer conversion on the input
within a try/except block. If the user-supplied input is not numeric, this will raise a ValueError. By
avoiding eval(), there is no opportunity for the input string to be executed as code.
Example Language: Python (Good)
def main():
sum = 0
numbers = input("Enter a space-separated list of numbers: ").split(" ")
try:
for num in numbers:
sum = sum + int(num)
print(f"Sum of {numbers} = {sum}")
except ValueError:
print("Error: invalid input")
main()
CWE Version 4.14
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')