Weakness (CWE)
CWE-77: Command Injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
More detail
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
How to prevent it (5 mitigations)
-
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
-
Implementation
If possible, ensure that all external commands called from the program are statically created.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Operation
Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
-
System Configuration
Assign permissions that prevent the user from accessing/opening privileged files.
Source: MITRE CWE-77
1,207 results · Clear filters · Feed
-
High 7.4
Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4
pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system…
-
High 7.3
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Requ…
KEV Apr 11, 2024 -
High 8.0
Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the ntp_server parameter.
-
High 7.4
VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execu…
-
High 7.2
There is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administ…
-
High 8.8
Tenda F1202 v1.2.0.20(408) has a command injection vulnerablility in the formWriteFacMac function in the mac parameter.
-
High 7.3
Cockpit: command injection when deleting a sosreport with a crafted name
A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.
-
High 8.6CVE-2024-1540 Public exploit
Command Injection in gradio-app/gradio via deploy+test-visual.yml workflow
A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special elements used in a command. This vulnerability allows attackers to execute unauthorized commands, po…
-
High 8.1
Remote command execution in A-Tune-Collector
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/A-Tune-Collector…
-
High 8.8
HGW BL1500HM Ver 002.001.013 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary com…
-
High 8.8
A command injection vulnerability exists in the cgibin binary in DIR-845L router firmware <= v1.01KRb03.
-
High 7.3
Ruijie RG-NBS2009G-P EXCU_SHELL command injection
A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /EXCU_SHELL. The manipulation of the argument Command1 leads to command injection. The a…
-
High 8.4
astropy vulnerable to RCE in TranformGraph().to_dot_graph function
Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_grap…
-
High 8.8
There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker…
-
High 8.8CVE-2024-25228 EPSS 26%
Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerif…
-
High 7.5
Outlook for Android Information Disclosure Vulnerability
Outlook for Android Information Disclosure Vulnerability
-
High 7.3
PHOENIX CONTACT: Command injection in the OCPP Service
An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation.
-
High 7.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4,…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 7.2
TYPO3 Install Tool vulnerable to Code Execution
TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in form fields of the Install Tool. The fixed versions…
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 8.0
An issue was discovered in Linksys Router E1700 version 1.0.04 (build 3), allows authenticated attackers to execute arb…
-
High 8.8
Command Injection vulnerability in D-Link Dir 882 with firmware version DIR882A1_FW130B06 allows attackers to run arbit…
-
High 8.1
An issue in idocv v.14.1.3_20231228 allows a remote attacker to execute arbitrary code and obtain sensitive information…
-
High 8.7
Appliance mode iControl REST vulnerability
When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions…
-
High 8.8
Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device all…
-
High 7.5
Azure DevOps Server Remote Code Execution Vulnerability
Azure DevOps Server Remote Code Execution Vulnerability
-
High 7.8CVE-2024-23749 Public exploit
KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insuffi…
-
High 8.8
An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated comma…
-
High 7.4
Photo Station
An OS command injection vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: Photo Station…
-
High 8.8
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via…
-
High 7.2
An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method systemSettingsDnsDataAction at /opt/webapp/…
-
High 8.8
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via…