139
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Many injection attacks involve the disclosure of important
information -- in terms of both data sensitivity and
usefulness in further exploitation.
Access Control Bypass Protection Mechanism
In some cases, injectable code controls authentication; this
may lead to a remote vulnerability.
Other Alter Execution Logic
Injection attacks are characterized by the ability to
significantly change the flow of a given process, and in
some cases, to the execution of arbitrary code.
Integrity
Other
Other
Data injection attacks lead to loss of data integrity in nearly
all cases as the control-plane data injected is always
incidental to data recall or writing.
Non-Repudiation Hide Activities
Often the actions performed by injected control code are
unlogged.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Requirements
Programming languages and supporting technologies might be chosen which are not subject to
these issues.
Phase: Implementation
Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all
input.
Demonstrative Examples
Example 1:
This example code intends to take the name of a user and list the contents of that user's home
directory. It is subject to the first variant of OS command injection.
CWE Version 4.14
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component
('Injection')
CWE-74: Improper Neutralization of Special Elements in
Output Used by a Downstream Component ('Injection') 140
Example Language: PHP (Bad)
$userName = $_POST["user"];
$command = 'ls -l /home/' . $userName;
system($command);
The $userName variable is not checked for malicious input. An attacker could set the $userName
variable to an arbitrary OS command such as:
Example Language: (Attack)
;rm -rf /
Which would result in $command being:
Example Language: (Result)
ls -l /home/;rm -rf /
Since the semi-colon is a command separator in Unix, the OS would first execute the ls command,
then the rm command, deleting the entire file system.
Also note that this example code is vulnerable to Path Traversal (CWE-22) and Untrusted Search
Path (CWE-426) attacks.
Example 2:
Consider the following program. It intends to perform an "ls -l" on an input filename. The
validate_name() subroutine performs validation on the input to make sure that only alphanumeric
and "-" characters are allowed, which avoids path traversal (CWE-22) and OS command injection
(CWE-78) weaknesses. Only filenames like "abc" or "d-e-f" are intended to be allowed.
Example Language: Perl (Bad)
my $arg = GetArgument("filename");
do_listing($arg);
sub do_listing {
my($fname) = @_;
if (! validate_name($fname)) {
print "Error: name is not well-formed!\n";
return;
}
# build command
my $cmd = "/bin/ls -l $fname";
system($cmd);
}
sub validate_name {
my($name) = @_;
if ($name =~ /^[\w\-]+$/) {
return(1);
}
else {
return(0);
}
}
However, validate_name() alows filenames that begin with a "-". An adversary could supply a
filename like "-aR", producing the "ls -l -aR" command (CWE-88), thereby getting a full recursive
listing of the entire directory and all of its sub-directories.
There are a couple possible mitigations for this weakness. One would be to refactor the code to
avoid using system() altogether, instead relying on internal functions.
CWE Version 4.14
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component
('Injection')
CWE-74: Improper Neutralization of Special Elements in
Output Used by a Downstream Component ('Injection')