CWE-96: Improper Sanitization of Directives in Statically Saved Code ('Static Code Injection')
Improper Sanitization of Directives in Statically Saved Code ('Static Code Injection')
Weakness ID: 96 (Weakness Base)
Status: Draft
Description
Description Summary
The software receives input from an upstream component, but it
does not sanitize or incorrectly sanitizes code syntax before inserting the
input into an executable resource, such as a library, configuration file, or
template.
PHP code from User-Agent HTTP header directly
inserted into log file implemented as PHP
script.
Potential Mitigations
Phase
Description
Assume all input is malicious. Use an appropriate combination of black
lists and white lists to filter code syntax from user-controlled
input.
Avoid writing user-controlled input to code files.
Perform output validation to filter all code syntax from data written
to non-code files.
Other Notes
"HTML injection" (see XSS) could be thought of as an example of this, but
it is executed on the client side, not the server side. Server-Side Includes
(SSI) are an example of direct static code injection.
This issue is most frequently found in PHP applications that allow users
to set configuration variables that are stored within executable php files.
Technically, this could also be performed in some compiled code (e.g. by
byte-patching an executable), although it is highly unlikely.
Weakness Ordinalities
Ordinality
Description
Primary
(where the
weakness exists independent of other weaknesses)
Description
