161
Reference Description
https://www.cve.org/CVERecord?id=CVE-2002-0061
CVE-2003-0041 FTP client does not filter "|" from filenames returned by the server, allowing for
OS command injection.
https://www.cve.org/CVERecord?id=CVE-2003-0041
CVE-2008-2575 Shell metacharacters in a filename in a ZIP archive
https://www.cve.org/CVERecord?id=CVE-2008-2575
CVE-2002-1898 Shell metacharacters in a telnet:// link are not properly handled when the
launching application processes the link.
https://www.cve.org/CVERecord?id=CVE-2002-1898
CVE-2008-4304 OS command injection through environment variable.
https://www.cve.org/CVERecord?id=CVE-2008-4304
CVE-2008-4796 OS command injection through https:// URLs
https://www.cve.org/CVERecord?id=CVE-2008-4796
CVE-2007-3572 Chain: incomplete denylist for OS command injection
https://www.cve.org/CVERecord?id=CVE-2007-3572
CVE-2012-1988 Product allows remote users to execute arbitrary commands by creating a file
whose pathname contains shell metacharacters.
https://www.cve.org/CVERecord?id=CVE-2012-1988
Functional Areas
• Program Invocation
Affected Resources
• System Process
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 635 Weaknesses Originally Used by NVD from 2008 to 2016 635 2552
MemberOf 714 OWASP Top Ten 2007 Category A3 - Malicious File
Execution
629 2331
MemberOf 727 OWASP Top Ten 2004 Category A6 - Injection Flaws 711 2337
MemberOf 741 CERT C Secure Coding Standard (2008) Chapter 8 -
Characters and Strings (STR)
734 2344
MemberOf 744 CERT C Secure Coding Standard (2008) Chapter 11 -
Environment (ENV)
734 2348
MemberOf 751 2009 Top 25 - Insecure Interaction Between
Components
750 2352
MemberOf 801 2010 Top 25 - Insecure Interaction Between
Components
800 2354
MemberOf 810 OWASP Top Ten 2010 Category A1 - Injection 809 2356
MemberOf 845 The CERT Oracle Secure Coding Standard for
Java (2011) Chapter 2 - Input Validation and Data
Sanitization (IDS)
844 2362
MemberOf 864 2011 Top 25 - Insecure Interaction Between
Components
900 2371
MemberOf 875 CERT C++ Secure Coding Section 07 - Characters and
Strings (STR)
868 2376
MemberOf 878 CERT C++ Secure Coding Section 10 - Environment
(ENV)
868 2378
MemberOf 884 CWE Cross-section 884 2567
CWE Version 4.14
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command
Injection')
CWE-78: Improper Neutralization of Special Elements
used in an OS Command ('OS Command Injection') 162
Nature Type ID Name Page
MemberOf 929 OWASP Top Ten 2013 Category A1 - Injection 928 2389
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1027 OWASP Top Ten 2017 Category A1 - Injection 1026 2435
MemberOf 1131 CISQ Quality Measures (2016) - Security 1128 2442
MemberOf 1134 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 00. Input Validation and Data Sanitization
(IDS)
1133 2444
MemberOf 1165 SEI CERT C Coding Standard - Guidelines 10.
Environment (ENV)
1154 2460
MemberOf 1200 Weaknesses in the 2019 CWE Top 25 Most Dangerous
Software Errors
1200 2587
MemberOf 1337 Weaknesses in the 2021 CWE Top 25 Most Dangerous
Software Weaknesses
1337 2589
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1350 Weaknesses in the 2020 CWE Top 25 Most Dangerous
Software Weaknesses
1350 2594
MemberOf 1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous
Software Weaknesses
1387 2597
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
MemberOf 1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous
Software Weaknesses
1425 2600
Notes
Terminology
The "OS command injection" phrase carries different meanings to different people. For some
people, it only refers to cases in which the attacker injects command separators into arguments
for an application-controlled program that is being invoked. For some people, it refers to any
type of attack that can allow the attacker to execute OS commands of their own choosing. This
usage could include untrusted search path weaknesses (CWE-426) that cause the application
to find and execute an attacker-controlled program. Further complicating the issue is the case
when argument injection (CWE-88) allows alternate command-line switches or options to be
inserted into the command line, such as an "-exec" switch whose purpose may be to execute the
subsequent argument as a command (this -exec switch exists in the UNIX "find" command, for
example). In this latter case, however, CWE-88 could be regarded as the primary weakness in a
chain with CWE-78.
Research Gap
More investigation is needed into the distinction between the OS command injection variants,
including the role with argument injection (CWE-88). Equivalent distinctions may exist in other
injection-related problems such as SQL injection.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER OS Command Injection
OWASP Top Ten 2007 A3 CWE More Specific Malicious File Execution
OWASP Top Ten 2004 A6 CWE More Specific Injection Flaws
CERT C Secure Coding ENV03-C Sanitize the environment when invoking
external programs
CERT C Secure Coding ENV33-C CWE More Specific Do not call system()
CERT C Secure Coding STR02-C Sanitize data passed to complex
subsystems
WASC 31 OS Commanding
CWE Version 4.14
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79: Improper Neutralization of Input During
Web Page Generation ('Cross-site Scripting')