|
 DescriptionDescription Summary The software receives input from an upstream component, but it
does not sanitize or incorrectly sanitizes code syntax before using the input in
a dynamic evaluation call (e.g. "eval").
Extended Description This may allow an attacker to execute arbitrary code, or at least modify what code can be executed. Time of Introduction
Applicable PlatformsLanguages Java Javascript Python Perl PHP Ruby Interpreted Languages Modes of Introduction
Likelihood of ExploitMedium Demonstrative ExamplesExample 1 edit-config.pl: This CGI script is used to modify settings in a configuration file. (Bad Code) Perl use CGI qw(:standard); sub config_file_add_key { my ($fname, $key, $arg) = @_;
# code to add a field/key to a file goes here
} sub config_file_set_key { my ($fname, $key, $arg) = @_;
# code to set key to a particular file goes here
} sub config_file_delete_key { my ($fname, $key, $arg) = @_;
# code to delete key from a particular file goes here
} sub handleConfigAction { my ($fname, $action) = @_;
my $key = param('key');
my $val = param('val');
# this is super-efficient code, especially if you have to
invoke
# any one of dozens of different functions!
my $code = "config_file_$action_key(\$fname, \$key,
\$val);";
eval($code);
} $configfile = "/home/cwe/config.txt"; print header; if (defined(param('action'))) { handleConfigAction($configfile, param('action'));
} else { print "No action specified!\n";
} The script intends to take the 'action' parameter and invoke one of a variety of functions based on the value of that parameter - config_file_add_key(), config_file_set_key(), or config_file_delete_key(). It could set up a conditional to invoke each function separately, but eval() is a powerful way of doing the same thing in fewer lines of code, especially when a large number of functions or variables are involved. Unfortunately, in this case, the attacker can provide other values in the action parameter, such as: add_key(",","); system("/bin/ls"); This would produce the following string in handleConfigAction(): config_file_add_key(",","); system("/bin/ls"); Any arbitrary Perl code could be added after the attacker has "closed off" the construction of the original function call, in order to prevent parsing errors from causing the malicious eval() to fail before the attacker's payload is activated. This particular manipulation would fail after the system() call, because the "_key(\$fname, \$key, \$val)" portion of the string would cause an error, but this is irrelevant to the attack because the payload has already been activated. Observed Examples
Potential Mitigations
Other Notes
Weakness Ordinalities
Relationships
Research Gaps
Causal NatureExplicit Taxonomy Mappings
Related Attack Patterns
References Content History
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Page Last Updated:
October 29, 2009
|
|
CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security. This Web site is hosted by The MITRE Corporation. Contact cwe@mitre.org for more information. |
|
|