145
Scope Impact Likelihood
Potential Mitigations
Phase: Requirements
Programming languages and supporting technologies might be chosen which are not subject to
these issues.
Phase: Implementation
Utilize an appropriate mix of allowlist and denylist parsing to filter equivalent special element
syntax from all input.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Equivalent Special Element Injection
CWE-77: Improper Neutralization of Special Elements used in a Command
('Command Injection')
Weakness ID : 77
Structure : Simple
Abstraction : Class
Description
The product constructs all or part of a command using externally-influenced input from an upstream
component, but it does not neutralize or incorrectly neutralizes special elements that could modify
the intended command when it is sent to a downstream component.
Extended Description
Command injection vulnerabilities typically occur when:
1. Data enters the application from an untrusted source.
2. The data is part of a string that is executed as a command by the application.
3. By executing the command, the application gives an attacker a privilege or capability that the
attacker would not otherwise have.
Many protocols and products have their own custom command language. While OS or shell
command strings are frequently discovered and targeted, developers may not realize that these
other command languages might also be vulnerable to attacks.
Command injection is a common problem with wrapper programs.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-77: Improper Neutralization of Special
Elements used in a Command ('Command Injection') 146
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 74 Improper Neutralization of Special Elements in Output Used
by a Downstream Component ('Injection')