285
$fh = GetServerFileHandle("myserver");
print $fh "$cmd $argstr\n";
It is clear that, while the protocol and back-end allow multiple commands to be sent in a single
request, the front end only intends to send a single command. However, the UrlEncode function
could leave the "|" character intact. If an attacker provides:
Example Language: (Attack)
SAY hello world|BAN user12
then the front end will see this is a "SAY" command, and the $argstr will look like "hello world | BAN
user12". Since the command is "SAY", the check for the "BAN" command will fail, and the front end
will send the URL-encoded command to the back end:
Example Language: (Result)
SAY hello%20world|BAN%20user12
The back end, however, will treat these as two separate commands:
Example Language: (Result)
SAY hello world
BAN user12
Notice, however, that if the front end properly encodes the "|" with "%7C", then the back end will
only process a single command.
Example 3:
This example takes user input, passes it through an encoding scheme and then creates a directory
specified by the user.
Example Language: Perl (Bad)
sub GetUntrustedInput {
return($ARGV[0]);
}
sub encode {
my($str) = @_;
$str =~ s/\&/\&amp;/gs;
$str =~ s/\"/\&quot;/gs;
$str =~ s/\'/\&apos;/gs;
$str =~ s/\</\&lt;/gs;
$str =~ s/\>/\&gt;/gs;
return($str);
}
sub doit {
my $uname = encode(GetUntrustedInput("username"));
print "<b>Welcome, $uname!</b><p>\n";
system("cd /home/$uname; /bin/ls -l");
}
The programmer attempts to encode dangerous characters, however the denylist for encoding
is incomplete (CWE-184) and an attacker can still pass a semicolon, resulting in a chain with
command injection (CWE-77).
Additionally, the encoding routine is used inappropriately with command execution. An attacker
doesn't even need to insert their own semicolon. The attacker can instead leverage the encoding
routine to provide the semicolon to separate the commands. If an attacker supplies a string of the
form:
CWE Version 4.14
CWE-116: Improper Encoding or Escaping of Output
CWE-116: Improper Encoding or Escaping of Output