Weakness (CWE)
CWE-77: Command Injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
More detail
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
How to prevent it (5 mitigations)
-
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
-
Implementation
If possible, ensure that all external commands called from the program are statically created.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Operation
Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
-
System Configuration
Assign permissions that prevent the user from accessing/opening privileged files.
Source: MITRE CWE-77
3,210 results · Feed
-
High 8.4
astropy vulnerable to RCE in TranformGraph().to_dot_graph function
Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_grap…
-
Critical 9.8
FitNesse allows execution of arbitrary OS commands
FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation.
-
High 8.8
There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker…
-
Critical 10.0
There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker…
-
High 8.8CVE-2024-25228 EPSS 26%
Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerif…
-
High 7.5
Outlook for Android Information Disclosure Vulnerability
Outlook for Android Information Disclosure Vulnerability
-
High 7.3
PHOENIX CONTACT: Command injection in the OCPP Service
An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation.
-
Critical 9.1CVE-2024-22127 Public exploit
Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)
SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands…
-
Medium 6.3
1Panel swap baseApi.UpdateDeviceSwap command injection
A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input …
-
High 7.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4,…
-
Critical 9.3
PaddlePaddle command injection vulnerability
Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 7.2
TYPO3 Install Tool vulnerable to Code Execution
TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in form fields of the Install Tool. The fixed versions…
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 8.0
An issue was discovered in Linksys Router E1700 version 1.0.04 (build 3), allows authenticated attackers to execute arb…
-
Critical 9.8
In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the fi…
-
Medium 6.5CVE-2024-25082 Public exploit
Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.
-
Medium 4.2CVE-2024-25081 Public exploit
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
-
Medium 6.3
Totolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injection
A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation leads to command injection. The ex…
-
Critical 9.8CVE-2024-25850 EPSS 19%
Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter
-
Critical 9.4CVE-2024-23346 Public exploit
pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string
Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.…
-
High 8.8
Command Injection vulnerability in D-Link Dir 882 with firmware version DIR882A1_FW130B06 allows attackers to run arbit…
-
Critical 9.8
Command Injection vulnerability in D-Link Dir 816 with firmware version DIR-816_A2_v1.10CNB04 allows attackers to run a…
-
High 8.1
An issue in idocv v.14.1.3_20231228 allows a remote attacker to execute arbitrary code and obtain sensitive information…
-
High 8.7
Appliance mode iControl REST vulnerability
When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions…
-
High 8.8
Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device all…
-
Critical 9.1
Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the actions-console docker container while setting a service URL.…
-
High 7.5
Azure DevOps Server Remote Code Execution Vulnerability
Azure DevOps Server Remote Code Execution Vulnerability
-
Medium 5.8
QTS, QuTS hero, QuTScloud
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Q…
-
Critical 9.8
Emerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection
In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context from a remote computer.
-
Medium 6.9
Emerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection
In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an authenticated user with network access could run arbitrary commands from a remote computer.
-
High 7.8CVE-2024-23749 Public exploit
KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insuffi…
-
High 8.8
An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated comma…