Weakness (CWE)
CWE-78: OS Command Injection
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
How to prevent it (8 mitigations)
-
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
-
Architecture and Design, Operation
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
Be careful to avoid CWE-243 and other weaknesses related to jails.
-
Architecture and Design
For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error.
-
Implementation
While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or white space). If some special characters are still needed, such as white space, wrap each argument in quotes after the escaping/filtering step. Be careful of argument injection (CWE-88).
-
Implementation
If the program to be executed allows arguments to be specified within an input file or from standard input, then consider using that mode to pass arguments instead of the command line.
-
Architecture and Design
If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.
Some languages offer multiple functions that can be used to invoke commands. Where possible, identify any function that invokes a command shell using a single string, and replace it with a function that requires individual arguments. These functions typically perform appropriate quoting and filtering of arguments. For example, in C, the system() function accepts a string that contains the entire command to be executed, whereas execl(), execve(), and others require an array of strings, one for each argument. In Windows, CreateProcess() only accepts one command at a time. In Perl, if system() is provided with an array of arguments, then it will quote each of the arguments.
Source: MITRE CWE-78
2,705 results · Clear filters · Feed
-
High 8.1
Remote code execution in simple-git
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of [CVE-2022-25912]…
-
High 7.4
Command Injection in puppet-facter
All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.
-
High 7.4
Command Injection in create-choo-electron
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.
-
High 8.8CVE-2023-24422 Public exploit
Sandbox bypass in Jenkins Script Security Plugin
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execut…
-
High 7.8CVE-2022-45639 Public exploit
OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a cr…
-
High 8.8
The management portal component of JetNexus/EdgeNexus ADC 4.2.8 was discovered to contain a command injection vulnerabi…
-
High 8.8CVE-2023-23596 EPSS 16%
jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds a…
-
High 8.8
OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This …
-
High 7.2
MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, a…
-
High 8.0
OS command injection vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and RT100_TEQ_2.1.2_EQ101 allows a netwo…
-
High 8.8
Autolab is vulnerable to remote code execution (RCE) via MOSS functionality
Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution vulnerability was dis…
-
High 7.4
global-modules-path Command Injection vulnerability
Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.
-
High 7.2
NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, …
-
High 7.2
NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, …
-
High 7.2
NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, …
-
High 7.2
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r…
-
High 7.4
wifey vulnerable to Command Injection due to improper input sanitization
All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization.
-
High 8.8
Local Privilege Escalation in Zoom Rooms for macOS Clients
Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
-
High 7.2CVE-2022-43973 Public exploit
Arbitrary code execution in Linksys WRT54GL
An arbitrary code execution vulnerability exisits in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. The Check_TSSI function within the httpd binary uses unvalidated user input in the construction of a system command. An authenticate…
-
High 7.2
Arbitrary code execution in Linksys WUMC710
An arbitrary code exection vulnerability exists in Linksys WUMC710 Wireless-AC Universal Media Connector with firmware <= 1.0.02 (build3). The do_setNTP function within the httpd binary uses unvalidated user input in the construction of a system command. An a…
-
High 7.4
exec-local-bin vulnerable to Command Injection
Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper user-input sanitization.
-
High 8.8
The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution b…
-
High 7.4
window-control vulnerable to Command Injection due to improper input sanitization
Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization.
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 8.6
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC versi…
-
High 7.6
Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CW…
-
High 8.8
ChangingTec ServiSign - Command Injection
ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers command injection and allo…
-
High 7.2
Realtek GPON router - Command Injection
Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt s…
-
High 8.8CVE-2022-40005 EPSS 35%
Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by th…
-
High 7.4
Command Injection
All versions of package abacus-ext-cmdline are vulnerable to Command Injection via the execute function due to improper user-input sanitization.
-
High 7.4
Command Injection
The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization
-
High 7.8
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A cr…
-
High 8.8CVE-2022-45942 EPSS 22%
A Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4.
-
High 8.0
OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitra…
-
High 7.8
PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an attacker to gain root access through command…
-
High 8.8
The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user …
-
High 7.8
The default console presented to users over telnet (when enabled) is restricted to a subset of commands. Commands issue…
-
High 7.4
Command Injection
The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization.