Weakness (CWE)
CWE-78: OS Command Injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
How to prevent it (8 mitigations)
-
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
-
Architecture and Design, Operation
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
Be careful to avoid CWE-243 and other weaknesses related to jails.
-
Architecture and Design
For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error.
-
Implementation
While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or white space). If some special characters are still needed, such as white space, wrap each argument in quotes after the escaping/filtering step. Be careful of argument injection (CWE-88).
-
Implementation
If the program to be executed allows arguments to be specified within an input file or from standard input, then consider using that mode to pass arguments instead of the command line.
-
Architecture and Design
If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.
Some languages offer multiple functions that can be used to invoke commands. Where possible, identify any function that invokes a command shell using a single string, and replace it with a function that requires individual arguments. These functions typically perform appropriate quoting and filtering of arguments. For example, in C, the system() function accepts a string that contains the entire command to be executed, whereas execl(), execve(), and others require an array of strings, one for each argument. In Windows, CreateProcess() only accepts one command at a time. In Perl, if system() is provided with an array of arguments, then it will quote each of the arguments.
Source: MITRE CWE-78
2,705 results · Clear filters · Feed
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-…
-
High 8.4
Command injection in discordrb
discordrb is an implementation of the Discord API using Ruby. In discordrb before commit `91e13043ffa` the `encoder.rb` file unsafely constructs a shell string using the file parameter, which can potentially leave clients of discordrb vulnerable to command in…
-
High 8.3
OS Command Injection via GIT_PATH in pymedusa
pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. An attacker may exploit t…
-
High 7.2
HGiga MailSherlock - Command Injection
HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote attacker with administrator privilege can exploit this vulnerability to inject and execute arbitrary system commands to …
-
High 8.8
HGiga PowerStation - Command Injection
HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system op…
-
High 7.8
org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary co…
-
High 7.8
DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inje…
-
High 7.8
emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto:…
-
High 7.2
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb versi…
-
High 7.3
mailcow is vulnerable to shell command injection via xoauth2 authentication in imapsync
mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard users by assigning them the necessary permission - suffers from a shell command injection. A maliciou…
-
High 7.2
On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injecti…
-
High 7.1CVE-2023-26039 Public exploit
ZoneMinder vulnerable to OS Command injection in daemonControl() API
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl() in (/web/api/app/Controller/HostCon…
-
High 8.0
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface…
-
High 7.4
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC versi…
-
High 7.0
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender …
-
High 8.6
An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.…
-
High 7.2
PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains OS Command Injection vulnerability. An aut…
-
High 8.8CVE-2022-46649 Public exploit
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to …
-
High 7.2
A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4…
-
High 7.5
[RANCHER] OS command injection in Rancher and Fleet
A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allows remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. This issue affect…
-
High 8.8CVE-2022-45768 EPSS 29%
Command Injection vulnerability in Edimax Technology Co., Ltd. Wireless Router N300 Firmware BR428nS v3 allows attacker…
-
High 7.6
Rancher: Command injection in Git package
A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with the ability to add an untrusted Helm catalog or modifying the URL configuration used to download KDM…
-
High 7.4
semver-tags is vulnerable to Command Injection via the getGitTagsRemote function
All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization.
-
High 7.4
create-choo-app3 is vulnerable to Command Injection via the devInstall function
All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.
-
High 8.8
D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the la…
-
High 8.8
Dell EMC prior to version DDOS 7.9 contain(s) an OS command injection Vulnerability. An authenticated non admin attacke…
-
High 7.4
is-http2 vulnerable to Improper Input Validation
All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function.
-
High 7.4
mt7688-wiscan is vulnerable to Command Injection due to improper input sanitization
Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function.
-
High 7.4
nemo-appium vulnerable to OS Command Injection
Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. **Note:** In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of…
-
High 7.8
Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the …
-
High 7.5
Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter.
-
High 7.8
Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in th…
-
High 7.2
An os command injection vulnerability exists in the httpd delfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210…
-
High 7.2
An OS command injection vulnerability exists in the httpd txt/restore.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5…
-
High 7.2
An OS command injection vulnerability exists in the httpd SNMP functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link …
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link …
-
High 7.4
Command injection in vagrant.js
All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.
-
High 7.4
Command injection in smartctl
All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.