Weakness (CWE)
CWE-77: Command Injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
More detail
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
How to prevent it (5 mitigations)
-
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
-
Implementation
If possible, ensure that all external commands called from the program are statically created.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Operation
Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
-
System Configuration
Assign permissions that prevent the user from accessing/opening privileged files.
Source: MITRE CWE-77
1,205 results · Clear filters · Feed
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an unauthorized attacker to execute code over a network.
-
High 8.6
Visual Studio Code Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.
-
High 8.2
Azure Pipelines Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.
-
High 8.0
Active Directory Domain Services Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Windows Task Scheduler Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.
-
High 8.0
Authenticated Command Injection
Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially …
-
High 8.8
FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, sofia_handle_sip_i_refer() placed raw Refer-To URI paramete…
-
High 8.8
ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`)
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept scan_ports from any authenticated session, including non-admin…
-
High 7.3
agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection
A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/_config.py of the component MCP Workspace API. The manipulation of the argument command results in os c…
-
High 7.3
Qihoo 360 D603-2/D600-2/D606-6 Timezone Push iscm on_push_message os command injection
A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message of the file /fs2/bin/iscm of the component Timezone Push Handler. Executing a manipulation of the argument tz can lead t…
-
High 7.2
On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessibl…
-
High 7.2
Authenticated Command Injection Vulnerability in HPE Networking VIA
A command injection vulnerability exists in HPE Networking VIA. Successful exploitation could allow an authenticated administrative user to execute arbitrary commands with elevated privileges on the underlying operating system.
-
High 7.8
Authenticated Local Command Injection Vulnerability in the VIA Client for Linux
A command injection vulnerability exists in the VIA client for Linux. Successful exploitation could allow a low-privileged local attacker to execute arbitrary commands with elevated privileges on the affected system.
-
High 7.2
Command Injection in IPsec VPN
Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.
-
High 7.2
Command Injection in WireGuard VPN
Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.
-
High 7.2
Command Injection in ZeroTier VPN
Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.
-
High 7.8
SQLite CLI through 3.54.1 Command Injection via .recover Output
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE …
-
High 8.8
Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.
Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.
-
High 8.8
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
-
High 8.8
Stack File Trusted Markdown Injection in Autodesk Fusion Post Processor Utility
A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post Processor Utility Extension. A malicious actor may exploit this vulnerability to execute arbitrary commands in the context of the current use…
-
High 7.3
desmondmorris node-tesseract Command Builder tesseract.js process os command injection
A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. Th…
-
High 8.7
Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation
A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by…
-
High 7.3
Travisun Opptrix Schedule API setup command injection
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been publi…
-
High 7.5
@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function
An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.
-
High 7.5
@rog0x/mcp-docker-tools: executes arbitrary code via the handleImageList function
An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.
-
High 7.2
Authenticated Command Injection Vulnerabilities in AOS-10
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a…
-
High 7.2
Authenticated File Write leads to Command Injection Vulnerabilities in AOS-10
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a…
-
High 7.2
Authenticated Command Injection Vulnerabilities in AOS-8
Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the…
-
High 7.2
Authenticated Command Injection Vulnerabilities in AOS-8
Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the…
-
High 7.2
Improper Sanitization leads to Command Injection in AOS-8 Web Interface
A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands …
-
High 8.1
Unauthenticated Command Injection Vulnerabilities in AOS-8 Accessed by the PAPI Protocol
There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privil…
-
High 8.3
Unauthenticated Adjacent Command Injection Vulnerability in the PAPI Protocol of AOS-10
There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets. Successful exploitation of this vulnerability could allow an attacker…
-
High 8.8
Unauthenticated Adjacent Command Injection Vulnerability in the AOS-8 Command Line Interface Accessed by the PAPI Protocol
A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211. Successf…
-
High 8.8
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunToo…
-
High 7.5
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-co…
-
High 7.4
DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection
A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to comma…
-
High 7.4
DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection
A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command…
-
High 8.6
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the sys…
-
High 7.3
orbitale imagemagick-php Command.php font os command injection
A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be execute…
-
High 8.8
WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action
The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `…