141
Another option could be to add a "--" argument to the ls command, such as "ls -l --", so that any
remaining arguments are treated as filenames, causing any leading "-" to be treated as part of a
filename instead of another option.
Another fix might be to change the regular expression used in validate_name to force the first
character of the filename to be a letter or number, such as:
Example Language: Perl (Good)
if ($name =~ /^\w[\w\-]+$/) ...
Observed Examples
Reference Description
CVE-2022-36069 Python-based dependency management tool avoids OS command injection
when generating Git commands but allows injection of optional arguments with
input beginning with a dash, potentially allowing for code execution.
https://www.cve.org/CVERecord?id=CVE-2022-36069
CVE-1999-0067 Canonical example of OS command injection. CGI program does not
neutralize "|" metacharacter when invoking a phonebook program.
https://www.cve.org/CVERecord?id=CVE-1999-0067
CVE-2022-1509 injection of sed script syntax ("sed injection")
https://www.cve.org/CVERecord?id=CVE-2022-1509
CVE-2020-9054 Chain: improper input validation (CWE-20) in username parameter, leading to
OS command injection (CWE-78), as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-9054
CVE-2021-44228 Product does not neutralize ${xyz} style expressions, allowing remote code
execution. (log4shell vulnerability)
https://www.cve.org/CVERecord?id=CVE-2021-44228
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 727 OWASP Top Ten 2004 Category A6 - Injection Flaws 711 2337
MemberOf 929 OWASP Top Ten 2013 Category A1 - Injection 928 2389
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1003 Weaknesses for Simplified Mapping of Published
Vulnerabilities
1003 2576
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Notes
Theoretical
Many people treat injection only as an input validation problem (CWE-20) because many people
do not distinguish between the consequence/attack (injection) and the protection mechanism that
prevents the attack from succeeding. However, input validation is only one potential protection
mechanism (output encoding is another), and there is a chaining relationship between improper
input validation and the improper enforcement of the structure of messages to other components.
Other issues not directly related to input validation, such as race conditions, could similarly
impact message structure.
Taxonomy Mappings
CWE Version 4.14
CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
CWE-75: Failure to Sanitize Special Elements
into a Different Plane (Special Element Injection) 142
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Injection problem ('data' used as
something else)
OWASP Top Ten 2004 A6 CWE More Specific Injection Flaws
Software Fault Patterns SFP24 Tainted input to command
Related Attack Patterns
CAPEC-ID Attack Pattern Name
3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
6 Argument Injection
7 Blind SQL Injection
8 Buffer Overflow in an API Call
9 Buffer Overflow in Local Command-Line Utilities
10 Buffer Overflow via Environment Variables
13 Subverting Environment Variable Values
14 Client-side Injection-induced Buffer Overflow
24 Filter Failure through Buffer Overflow
28 Fuzzing
34 HTTP Response Splitting
42 MIME Conversion
43 Exploiting Multiple Input Interpretation Layers
45 Buffer Overflow via Symbolic Links
46 Overflow Variables and Tags
47 Buffer Overflow via Parameter Expansion
51 Poison Web Service Registry
52 Embedding NULL Bytes
53 Postfix, Null Terminate, and Backslash
64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
67 String Format Overflow in syslog()
71 Using Unicode Encoding to Bypass Validation Logic
72 URL Encoding
76 Manipulating Web Input to File System Calls
78 Using Escaped Slashes in Alternate Encoding
79 Using Slashes in Alternate Encoding
80 Using UTF-8 Encoding to Bypass Validation Logic
83 XPath Injection
84 XQuery Injection
101 Server Side Include (SSI) Injection
105 HTTP Request Splitting
108 Command Line Execution through SQL Injection
120 Double Encoding
135 Format String Injection
250 XML Injection
267 Leverage Alternate Encoding
273 HTTP Response Smuggling
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special
Element Injection)
CWE Version 4.14
CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
CWE-75: Failure to Sanitize Special Elements
into a Different Plane (Special Element Injection)