Weakness (CWE)
CWE-77: Command Injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
More detail
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
How to prevent it (5 mitigations)
-
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
-
Implementation
If possible, ensure that all external commands called from the program are statically created.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Operation
Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
-
System Configuration
Assign permissions that prevent the user from accessing/opening privileged files.
Source: MITRE CWE-77
818 results · Clear filters · Feed
-
Critical 9.8CVE-2022-39073 Public exploit
There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an at…
-
Critical 9.8
In Boa, there is a possible command injection due to improper input validation. This could lead to remote escalation of…
-
Critical 9.8
Apache Kylin: Command injection by Diagnosis Controller
Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.
-
Critical 9.9
D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the lan(0)_dhcps_staticlist …
-
Critical 9.9
D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parame…
-
Critical 9.6
Activity Watch vulnerable to command execution on macOS via printAppTitle.scpt
Activity Watch is a free and open-source automated time tracker. Versions prior to 0.11.0 allow an attacker to execute arbitrary commands on any macOS machine with ActivityWatch running. The attacker can exploit this vulnerability by having the user visiting …
-
Critical 9.8
Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_params
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 5.0.0.
-
Critical 9.1
SHARP Multifunction Printer - Command Injection
Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 or earlier, 120 or earlier, 600 or earlier, 121 or earlier, 500 or earlier, 402 or earlier, 790 or earlier, and Digital…
-
Critical 9.8
vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. A malicious ac…
-
Critical 9.8
D-Link DIR-3040 device with firmware 120B03 was discovered to contain a command injection vulnerability via the SetTrig…
-
Critical 9.8
A command injection vulnerability has been identified in Atos Unify OpenScape 4000 Assistant and Unify OpenScape 4000 M…
-
Critical 9.8
PyTorch vulnerable to arbitrary code execution
In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.
-
Critical 9.8CVE-2020-23583 Public exploit
OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary…
-
Critical 9.8
Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes a…
-
Critical 9.8
Apache DolphinScheduler prior to 2.0.5 have command execution vulnerability
Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher
-
Critical 9.8
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker…
-
Critical 9.9
DLINK - DSL-224 Post-auth RCE.
DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is possible to inject a command through this interface that will run with ROOT permissions on the router.
-
Critical 9.8
SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php
-
Critical 9.8
IBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of spec…
-
Critical 9.8
D-Link DIR-823G v1.0.2 was found to contain a command injection vulnerability in the function SetNetworkTomographySetti…
-
Critical 9.8
IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the formSetDebugCfg functio…
-
Critical 9.1
An OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16…
-
Critical 9.8
D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as…
KEV Jan 8, 2024 -
Critical 9.8CVE-2022-24697 EPSS 85%
Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters
Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any o…
-
Critical 9.8
Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privileg…
-
Critical 9.8
Tenda i9 v1.0.0.8(3828) was discovered to contain a command injection vulnerability via the FormexeCommand function.
-
Critical 10.0
iSTAR Ultra
All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the system.
-
Critical 9.8
Arbitrary Command Injection
All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child_process.exec() function.
-
Critical 9.9CVE-2022-2234 EPSS 42%
mySCADA myPRO Command Injection
An authenticated mySCADA myPRO 8.26.0 user may be able to modify parameters to run commands directly in the operating system.
-
Critical 9.8CVE-2022-21186 EPSS 26%
Arbitrary Command Injection
The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input.
-
Critical 9.8
Command Injection
This affects all versions of package monorepo-build.
-
Critical 9.4
Command Injection
This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js.
-
Critical 9.4
Command Injection
This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js.
-
Critical 9.8
-
Critical 9.4
Command Injection
This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js.
-
Critical 9.8
Command Injection
This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath)
-
Critical 9.4
Command Injection
This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.
-
Critical 9.8
Command Injection
This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js
-
Critical 9.8
Command Injection
The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js.
-
Critical 9.8
Command Injection
This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js.