Weakness (CWE)
CWE-77: Command Injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
More detail
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
How to prevent it (5 mitigations)
-
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
-
Implementation
If possible, ensure that all external commands called from the program are statically created.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Operation
Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
-
System Configuration
Assign permissions that prevent the user from accessing/opening privileged files.
Source: MITRE CWE-77
3,210 results · Feed
-
Critical 9.4
Command Injection
This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js.
-
Critical 9.8
-
Critical 9.4
Command Injection
This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js.
-
Unscored —
Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remo…
-
Unscored —
Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, t…
-
Critical 9.8
Command Injection
This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath)
-
Critical 9.4
Command Injection
This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.
-
High 7.3
Command Injection
This affects all versions of package google-cloudstorage-commands.
-
Medium 6.4
Command Injection
All versions of package git-archive are vulnerable to Command Injection via the exports function.
-
Critical 9.8
Command Injection
This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js
-
Critical 9.8
Command Injection
The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js.
-
Critical 9.8
Command Injection
This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js.
-
Critical 9.8
Advantech iView
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.
-
High 8.1CVE-2022-0902 EPSS 17%
ABB Flow Computer and Remote Controllers Path Traversal Vulnerability in Totalflow TCP protocol can lead to root access
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-…
-
Critical 10.0
Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload
Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py fil…
-
High 8.4
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions <…
-
Unscored —
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < 2.15.1), RUGGEDCOM ROX MX5000RE (All versio…
-
High 8.1
Command Injection
All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the --upload-pack feature of git.
-
High 8.8
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application con…
-
High 8.4
Code Injection in nuitka/nuitka
Code Injection in GitHub repository nuitka/nuitka prior to 0.9.
-
High 7.2
Command Injection
All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SNYK-JS-GITPROMISE-567476) in this package. **Note:** Please note that the vulnerability will not be f…
-
High 8.8
SevOne Network Management System Traceroute traceroute.php command injection
A vulnerability classified as critical has been found in SevOne Network Management System up to 5.7.2.22. This affects the file traceroute.php of the Traceroute Handler. The manipulation leads to privilege escalation with a command injection. It is possible t…
-
Medium 6.5
Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environment
sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` time when installing versions of `sharp` prior to the latest v0.30.5. If an attacker has the ability to…
-
High 8.6
HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion
go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.
-
Critical 9.8
Commandline class shell injection vulnerabilities
In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
-
High 8.8
Command Injection/Argument Injection in GoCD
GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create pipeline materials or pipeline configuration repositories to get remote code execution capability on…
-
High 8.1
Command Injection
The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch(remote: string, remoteBranch: string, cwd: string) function, both the remote and remoteBranch parameters are passed to…
-
Critical 9.9CVE-2022-26085 EPSS 13%
An OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.…
-
Critical 9.9
An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.…
-
Critical 9.1
An OS command injection vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4…
-
Critical 9.8
Vulnerability in QVR
We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.6 build 20220401 and later
-
High 8.8
Command injection
A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions…
-
High 8.7
On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 B…
-
High 7.7
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 1…
-
Medium 4.7
Cisco Small Business RV Series Routers Command Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. The…
-
Medium 4.7
Cisco Small Business RV Series Routers Command Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. The…
-
Critical 9.8
Command Injection
The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath …
-
Critical 9.9
Command Injection Vulnerability in hestiacp/hestiacp
Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context.
-
High 8.8
Bender Charge Controller: Command injection via Web interface
In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields.
-
High 8.1
Command Injection
The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in …