Weakness (CWE)
CWE-77: Command Injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
More detail
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
How to prevent it (5 mitigations)
-
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
-
Implementation
If possible, ensure that all external commands called from the program are statically created.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Operation
Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
-
System Configuration
Assign permissions that prevent the user from accessing/opening privileged files.
Source: MITRE CWE-77
3,210 results · Feed
-
High 8.8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary comma…
-
Medium 6.3
didi Super-Jacoco triggerEnvCov command injection
A vulnerability was found in didi Super-Jacoco 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cov/triggerEnvCov. The manipulation of the argument uuid leads to command injection. The attack can be initiated remotel…
-
High 7.2CVE-2024-10429 EPSS 18%
WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi set_ipv6 command injection
A vulnerability classified as critical has been found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. Affected is the function set_ipv6 of the file internet.cgi. The manipulation of the argument IPv6OpMode/IPv6IPAddr/IPv6WANIPAddr/IPv6GWAddr leads t…
-
High 7.2CVE-2024-10428 EPSS 15%
WAVLINK WN530H4/WN530HG4/WN572HG3 firewall.cgi set_ipv6 command injection
A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been rated as critical. This issue affects the function set_ipv6 of the file firewall.cgi. The manipulation of the argument dhcpGateway leads to command injection. The …
-
High 7.5
A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 …
-
High 7.5
A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows a…
-
High 7.5CVE-2024-48139 Public exploit
A prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95 allows attackers to access and exfiltrate all pr…
-
Critical 9.1
A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attack…
-
High 7.5
A prompt injection vulnerability in the chatbox of Zhipu AI CodeGeeX v2.17.0 allows attackers to access and exfiltrate …
-
High 8.8
Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered …
-
Critical 9.1
A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to …
-
High 8.8
Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETS_v3.2.468.11.04_P4 was discovered to contai…
-
Critical 9.8
An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on…
-
Critical 9.8
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to con…
-
Critical 9.8
An issue in DCME-320-L <=9.3.2.114 allows a remote attacker to execute arbitrary code via the log_u_umount.php componen…
-
Critical 9.1
A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to exe…
-
Medium 4.7CVE-2024-10193 EPSS 15%
WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi ping_ddns command injection
A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028 and classified as critical. This issue affects the function ping_ddns of the file internet.cgi. The manipulation of the argument DDNS leads to command injection. The attack may…
-
Critical 9.9
Grafana SQL Expressions allow for remote code execution
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulner…
-
High 7.2CVE-2024-6333 Public exploit
Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products
Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products.
-
High 8.4
Netgear R7000 1.0.11.136 is vulnerable to Command Injection in RMT_invite.cgi via device_name2 parameter.
-
High 8.4
Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in genie_fix2.cgi via the wan_dns1_pri parameter.
-
Critical 9.8
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary com…
-
High 7.3
Junos Space: Remote Command Execution (RCE) vulnerability in web application
A Command Injection vulnerability in Juniper Networks Junos Space allows an unauthenticated, network-based attacker sending a specially crafted request to execute arbitrary shell commands on the Junos Space Appliance, leading to remote command execution by th…
-
High 8.4CVE-2024-35517 EPSS 15%
Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usb_remote_smb_conf.cgi via the share_name parameter.
-
High 8.4
Netgear EX3700 ' AC750 WiFi Range Extender Essentials Edition before 1.0.0.98 contains an authenticated command injecti…
-
High 8.8
A vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical. This issue affects the upg…
-
Medium 6.3CVE-2024-9793 EPSS 23%
Tenda AC1206 ate ate_ifconfig_set command injection
A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23. This vulnerability affects the function ate_iwpriv_set/ate_ifconfig_set of the file /goform/ate. The manipulation leads to command injection. The attack can be initiated remot…
-
Medium 6.7
VMware NSX contains a command injection vulnerability. A malicious actor with access to the NSX Edge CLI terminal may …
-
High 7.8
Improper neutralization special element in hyperlinks
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements.
-
High 8.4
check_by_ssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution via ProxyCommand, LocalCommand, and Perm…
-
High 8.7
Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability
Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability
-
High 8.4
DeepSpeed Remote Code Execution Vulnerability
DeepSpeed Remote Code Execution Vulnerability
-
High 7.8
Visual Studio Code for Linux Remote Code Execution Vulnerability
Visual Studio Code for Linux Remote Code Execution Vulnerability
-
High 7.2
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authe…
KEV Oct 9, 2024 -
High 8.8
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does no…
-
Medium 6.0
Cisco Expressway Series Privilege Escalation Vulnerability
A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker…
-
Critical 9.9
Cisco Nexus Dashboard Fabric Controller Web UI Command Injection Vulnerability
A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to perform a command injection attack against an affected device. This vulnerability is due to im…
-
Medium 6.5
Cisco Integrated Management Controller Redfish Command Injection Vulnerability
A vulnerability in the Redfish API of Cisco UCS B-Series, Cisco UCS Managed C-Series, and Cisco UCS X-Series Servers could allow an authenticated, remote attacker with administrative privileges to perform command injection attacks on an affected system and el…
-
High 7.1
Local command injection in Wiz Code Visual Studio Code extension
Wiz Code Visual Studio Code extension in versions 1.0.0 up to 1.5.3 and Wiz (legacy) Visual Studio Code extension in versions 0.13.0 up to 0.17.8 are vulnerable to local command injection if the user opens a maliciously crafted Dockerfile located in a path th…
-
High 8.0
Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function.