197
Use dynamic tools and techniques that interact with the product using large test suites with
many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The
product's operation may slow down, but it should not become unstable, crash, or generate
incorrect results.
Demonstrative Examples
Example 1:
Consider the following program. It intends to perform an "ls -l" on an input filename. The
validate_name() subroutine performs validation on the input to make sure that only alphanumeric
and "-" characters are allowed, which avoids path traversal (CWE-22) and OS command injection
(CWE-78) weaknesses. Only filenames like "abc" or "d-e-f" are intended to be allowed.
Example Language: Perl (Bad)
my $arg = GetArgument("filename");
do_listing($arg);
sub do_listing {
my($fname) = @_;
if (! validate_name($fname)) {
print "Error: name is not well-formed!\n";
return;
}
# build command
my $cmd = "/bin/ls -l $fname";
system($cmd);
}
sub validate_name {
my($name) = @_;
if ($name =~ /^[\w\-]+$/) {
return(1);
}
else {
return(0);
}
}
However, validate_name() allows filenames that begin with a "-". An adversary could supply a
filename like "-aR", producing the "ls -l -aR" command (CWE-88), thereby getting a full recursive
listing of the entire directory and all of its sub-directories.
There are a couple possible mitigations for this weakness. One would be to refactor the code to
avoid using system() altogether, instead relying on internal functions.
Another option could be to add a "--" argument to the ls command, such as "ls -l --", so that any
remaining arguments are treated as filenames, causing any leading "-" to be treated as part of a
filename instead of another option.
Another fix might be to change the regular expression used in validate_name to force the first
character of the filename to be a letter or number, such as:
Example Language: Perl (Good)
if ($name =~ /^\w[\w\-]+$/) ...
Example 2:
CVE-2016-10033 / [REF-1249] provides a useful real-world example of this weakness within
PHPMailer.
The program calls PHP's mail() function to compose and send mail. The fifth argument to mail() is
a set of parameters. The program intends to provide a "-fSENDER" parameter, where SENDER is
CWE Version 4.14
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-88: Improper Neutralization of Argument
Delimiters in a Command ('Argument Injection') 198
expected to be a well-formed email address. The program has already validated the e-mail address
before invoking mail(), but there is a lot of flexibility in what constitutes a well-formed email address,
including whitespace. With some additional allowed characters to perform some escaping, the
adversary can specify an additional "-o" argument (listing an output file) and a "-X" argument (giving
a program to execute). Additional details for this kind of exploit are in [REF-1250].
Observed Examples
Reference Description
CVE-2022-36069 Python-based dependency management tool avoids OS command injection
when generating Git commands but allows injection of optional arguments with
input beginning with a dash, potentially allowing for code execution.
https://www.cve.org/CVERecord?id=CVE-2022-36069
CVE-1999-0113 Canonical Example - "-froot" argument is passed on to another program,
where the "-f" causes execution as user "root"
https://www.cve.org/CVERecord?id=CVE-1999-0113
CVE-2001-0150 Web browser executes Telnet sessions using command line arguments that
are specified by the web site, which could allow remote attackers to execute
arbitrary commands.
https://www.cve.org/CVERecord?id=CVE-2001-0150
CVE-2001-0667 Web browser allows remote attackers to execute commands by spawning
Telnet with a log file option on the command line and writing arbitrary code into
an executable file which is later executed.
https://www.cve.org/CVERecord?id=CVE-2001-0667
CVE-2002-0985 Argument injection vulnerability in the mail function for PHP may allow
attackers to bypass safe mode restrictions and modify command line
arguments to the MTA (e.g. sendmail) possibly executing commands.
https://www.cve.org/CVERecord?id=CVE-2002-0985
CVE-2003-0907 Help and Support center in windows does not properly validate HCP URLs,
which allows remote attackers to execute arbitrary code via quotation marks in
an "hcp://" URL.
https://www.cve.org/CVERecord?id=CVE-2003-0907
CVE-2004-0121 Mail client does not sufficiently filter parameters of mailto: URLs when using
them as arguments to mail executable, which allows remote attackers to
execute arbitrary programs.
https://www.cve.org/CVERecord?id=CVE-2004-0121
CVE-2004-0473 Web browser doesn't filter "-" when invoking various commands, allowing
command-line switches to be specified.
https://www.cve.org/CVERecord?id=CVE-2004-0473
CVE-2004-0480 Mail client allows remote attackers to execute arbitrary code via a URI that
uses a UNC network share pathname to provide an alternate configuration file.
https://www.cve.org/CVERecord?id=CVE-2004-0480
CVE-2004-0489 SSH URI handler for web browser allows remote attackers to execute arbitrary
code or conduct port forwarding via the a command line option.
https://www.cve.org/CVERecord?id=CVE-2004-0489
CVE-2004-0411 Web browser doesn't filter "-" when invoking various commands, allowing
command-line switches to be specified.
https://www.cve.org/CVERecord?id=CVE-2004-0411
CVE-2005-4699 Argument injection vulnerability in TellMe 1.2 and earlier allows remote
attackers to modify command line arguments for the Whois program and
obtain sensitive information via "--" style options in the q_Host parameter.
https://www.cve.org/CVERecord?id=CVE-2005-4699
CVE-2006-1865 Beagle before 0.2.5 can produce certain insecure command lines to launch
external helper applications while indexing, which allows attackers to execute
arbitrary commands. NOTE: it is not immediately clear whether this issue
involves argument injection, shell metacharacters, or other issues.
CWE Version 4.14
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-88: Improper Neutralization of Argument
Delimiters in a Command ('Argument Injection')