CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.1)  
Search by ID:

CWE-94: Code Injection

Individual Definition in a New Window
Code Injection
Status: Draft
Weakness ID: 94 (Weakness Class)
Description
Summary

The product does not sufficiently filter code (control-plane) syntax from user-controlled input (data plane) when that input is used within code that the product generates.

Potential Mitigations
Implementation

Utilize an appropriate mix of whitelist and blacklist parsing to filter non-relevant code syntax from all input that should not contain code.

Run time: Run time policy enforcement may be used in a whitelist fashion to prevent execution of any non-sanctioned code.

Assign permissions to the software system that prevent the user from accessing/opening privileged files.

Research Gaps

Many of these weaknesses are under-studied and under-researched, and terminology is not sufficiently precise.

Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness ClassWeakness Class74Failure to Sanitize Data into a Different Plane (aka 'Injection')
Development Concepts (primary)699
Research Concepts (primary)1000
ChildOfWeakness ClassWeakness ClassWeakness Class691Insufficient Control Flow Management
Research Concepts1000
MemberOfViewView635Weaknesses Used by NVD
Weaknesses Used by NVD (primary)635
ParentOfWeakness BaseWeakness BaseWeakness Base621Variable Extraction Error
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base627Dynamic Variable Evaluation
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base95Insufficient Control of Directives in Dynamically Evaluated Code (aka 'Eval Injection')
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base96Insufficient Control of Directives in Statically Saved Code (Static Code Injection)
Development Concepts (primary)699
Research Concepts (primary)1000
CanFollowCompound Element: CompositeCompound Element: Composite98Insufficient Control of Filename for Include/Require Statement in PHP Program (aka 'PHP File Inclusion')
Development Concepts (primary)699
Research Concepts1000
Taxonomy Mappings
Mapped Taxonomy NameNode IDMapped Node Name
PLOVERCODECode Evaluation and Injection
Applicable Platforms
Languages
Interpreted languages (Sometimes)
Time of Introduction
* Architecture and Design
* Implementation
Related Attack Patterns
CAPEC-ID(CAPEC Version 1.1)Attack Pattern Name
35Leverage Executable Code in Nonexecutable Files
77Manipulating User-Controlled Variables
Content History
Submissions
PLOVER. (Externally Mined)
Modifications
Eric Dalci. Cigital. 2008-07-01. (External)
updated Time_of_Introduction
CWE Content Team. MITRE. 2008-09-08. (Internal)
updated Applicable_Platforms, Relationships, Research_Gaps, Taxonomy_Mappings
Back to top
Page Last Updated: November 24, 2008
 

CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

This Web site is hosted by The MITRE Corporation.
Copyright 2008, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation.

Contact cwe@mitre.org for more information.
Privacy policy
Terms of use
Contact us