|
|
|
|
CWE-78 Individual Dictionary Definition (Draft 9)
Weakness ID
| Status: Incomplete 78 (Weakness Base) | | Description | Summary The software fails to adequately filter OS command syntax from user-controlled input
and then allows potentially injected commands to execute within its context. A software system
that accepts and executes input in the form of operating system commands (e.g. system(), exec(),
open()) could allow an attacker with lesser privileges than the target software to execute
commands with the elevated privileges of the executing process. The problem is exacerbated if the
compromised process fails to follow the principle of least privilege. | | Alternate Terms | Shell injection, shell metacharacters | | Functional Area | Program invocation | | Affected Resource | System Process | | Potential Mitigations | Design: If at all possible, use library calls rather than external processes
to recreate the desired functionality Implementation: Utilize black-list parsing to filter non-relevant OS command syntax from all input. Implementation: Ensure that all external commands called from the program
are statically created, or -- if they must take input from a user -- that the input
and final line generated are vigorously white-list checked. Run time: Run time policy enforcement may be used in a white-list fashion to
prevent use of any non-sanctioned commands. Assign permissions to the software system that prevents the user from
accessing/opening privileged files. | | Observed Examples | | | Context Notes | Fault: unquoted special characters, input restriction error | | References | G. Hoglund and G. McGraw.
"Exploiting Software: How to Break Code". Addison-Wesley. February 2004. | | Relationships | | | Source Taxonomies | PLOVER - OS Command Injection | | Applicable Platforms | All | | Related Attack Patterns | | CAPEC-ID | Attack Pattern Name |
|---|
| 88 | OS Command Injection | | 15 | Command Delimiters | | 6 | Argument Injection | | 43 | Exploiting Multiple Input Interpretation Layers |
| | White Box Definition |
A weakness where the code path has:
1. start statement that accepts input
2. end statement that executes an operating system command where
a. the input is used as a part of the operating system command
b. the privilege of the operating system command is higher than privilege of the input and
c. the operating system command is undesirable
Where “undesirable” is defined through the following scenarios:
1. not validated
2. incorrectly validated
|
|
- Weakness
- Base
- Variant
- Class
- Chain
- Composite
- Category
- View
- Deprecated
