Weakness (CWE)
CWE-77: Command Injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
More detail
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
How to prevent it (5 mitigations)
-
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
-
Implementation
If possible, ensure that all external commands called from the program are statically created.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Operation
Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
-
System Configuration
Assign permissions that prevent the user from accessing/opening privileged files.
Source: MITRE CWE-77
3,210 results · Feed
-
Medium 5.5
Cisco IOS XE Software Web UI OS Command Injection Vulnerability
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying operating system of an affected device. The vulnerability exists because the affected softwar…
-
Unscored —
Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server
A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to ove…
-
High 7.5
Arbitrary Command Injection
This affects the package killport before 1.0.2. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will…
-
Critical 9.8
Command injection in eslint-fixer
The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The ozum/eslint-fixer GitHub repository ha…
-
High 7.5
Arbitrary Command Injection
This affects all versions of package port-killer. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC wi…
-
Medium 5.6
Arbitrary Command Injection
This affects all versions of package ps-kill. If (attacker-controlled) user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization in …
-
Medium 5.6
Arbitrary Command Injection
This affects all versions of package kill-process-by-name. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization in the inde…
-
High 8.6
Command Injection
This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.
-
Critical 9.8CVE-2020-8298 EPSS 11%
Command injection in fs-path
fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, and `removeSync` methods.
-
Unscored —
Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server
A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made …
-
High 7.8CVE-2020-28243 Public exploit
SaltStack Salt command injection via a crafted process name
An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blackliste…
-
Critical 9.8
SaltStack Salt command injection in the Salt-API when using the Salt-SSH client
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.p…
-
High 7.3
Command Injection
All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})
-
High 7.2
Command Injection
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
-
Medium 6.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R60…
-
High 8.8CVE-2020-27864 EPSS 10%
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-…
-
Critical 9.8
Command injection in samba-client
The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.
-
High 8.1
Remote Code Execution in SCIMono
In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system.
-
Critical 9.8
Command injection in gitlog
The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability.
-
Critical 9.8
command injection vulnerability in Helpdesk
The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.
-
Medium 6.9
Command execution due to unsanitized input in LifeShield DIY HD Video Doorbell
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell allows an attacker on the same network to execute commands on the device. This issue affects: ADT LifeS…
-
High 7.3
Command Injection
All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId.
-
Critical 9.8
Command Injection
All versions of package launchpad are vulnerable to Command Injection via stop.
-
Medium 6.3
Command Injection
This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.
-
High 7.2
Command Injection Vulnerability in QTS and QuTS hero
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions…
-
Critical 9.8
command_injection
This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js. The vulnerability is demonstrated with the following PoC:
-
Critical 9.8
Command Injection
This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModule).
-
High 8.8
Command Injection Vulnerability in QTS and QuTS hero
This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero.
-
High 7.2
Dolibarr authenticated Remote Code Execution
Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr…
-
Medium 5.2
sqlite ATTACH allows some filesystem access
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. In osquery before version 4.6.0, by using sqlite's ATTACH verb, someone with administrative access to osquery can cause reads and writes to arbitrary sqlite databa…
-
Unscored —
Command Injection Vulnerability in QTS and QuTS hero
This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5…
-
High 7.2
If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issu…
-
High 7.2
If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issu…
-
Medium 5.3
Argument injection in lettre
The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.
-
Unscored —
If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This iss…
-
High 7.0
Client-Side Command Injection in Rapid7 Metasploit
Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine.
-
Critical 9.8
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has alr…
KEV May 24, 2022 -
Low 3.5CVE-2020-15228 Public exploit
Environment Variable Injection in GitHub Actions
In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands,…
-
High —
Command Injection in entitlements
Versions of `entitlements` prior to 1.3.0 are vulnerable to Command Injection. The package does not validate input on the `entitlements` function and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. ## Recommendatio…