CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Description

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[object Object]

Common consequences

• Confidentiality,Integrity,Availability,Non-Repudiation→Execute Unauthorized Code or Commands,DoS: Crash, Exit, or Restart,Read Files or Directories,Modify Files or Directories
  Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is

Potential mitigations

• Architecture and Design
  If at all possible, use library calls rather than external processes to recreate the desired functionality.
• Architecture and Design,Operation
  [object Object]
• Architecture and Design
  For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.
• Architecture and Design
  For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
• Architecture and Design
  [object Object]
• Implementation
  While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or whit
• Implementation
  If the program to be executed allows arguments to be specified within an input file or from standard input, then consider using that mode to pass arguments instead of the command line.
• Architecture and Design
  [object Object]
• Implementation
  [object Object]
• Architecture and Design
  When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

Related CWEs

Recent CVEs classified under this CWE