CAPEC-15: Command Delimiters
Description
An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
- Likelihood of attack
- High
- Typical severity
- High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Inject Unexpected Items
Prerequisites
- Software's input validation or filtering must not detect and block presence of additional malicious command.
Skills required
- MediumThe attacker has to identify injection vector, identify the specific commands, and optionally collect the output, i.e. from an interactive session.
Consequences
- ConfidentialityIntegrityAvailability
Execute Unauthorized Commands
Run Arbitrary Code
- Confidentiality
Read Data
Mitigations
- Design: Perform allowlist validation against a positive specification for command length, type, and parameters.
- Design: Limit program privileges, so if commands circumvent program input validation or filter routines then commands do not running under a privileged account
- Implementation: Perform input validation for all remote content.
- Implementation: Use type conversions such as JDBC prepared statements.
Related weaknesses (CWE)
- CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')
- CWE-138Improper Neutralization of Special Elements
- CWE-140Improper Neutralization of Delimiters
- CWE-146Improper Neutralization of Expression/Command Delimiters
- CWE-154Improper Neutralization of Variable Name Delimiters
- CWE-157Failure to Sanitize Paired Delimiters
- CWE-184Incomplete List of Disallowed Inputs
- CWE-185Incorrect Regular Expression
- CWE-697Incorrect Comparison