ClassDraftCWE-77

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE Top 25 #23One of MITRE's most dangerous software weaknesses. Read our plain-English guide to Command Injection.

Description

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.

Abstraction: ClassAn abstract weakness, independent of any specific language or technology.
Likelihood of exploit: High
Status: Draft

Common consequences

IntegrityConfidentialityAvailability
Execute Unauthorized Code or Commands
If a malicious user injects a character (such as a semi-colon) that delimits the end of one command and the beginning of another, it may be possible to then insert an entirely new and unrelated command that was not intended to be executed. This gives an attacker a privilege or capability that they would not otherwise...

Potential mitigations

Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
Implementation
If possible, ensure that all external commands called from the program are statically created.
ImplementationInput Validation
Assume all input is malicious. Use an accept known good input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, boat may be syntactically valid...
Operation
Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
System Configuration
Assign permissions that prevent the user from accessing/opening privileged files.

Related weaknesses

Parent weaknesses

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Child weaknesses

CAPEC attack patterns that exploit it

Description

Common consequences

IntegrityConfidentialityAvailability

Execute Unauthorized Code or Commands

If a malicious user injects a character (such as a semi-colon) that delimits the end of one command and the beginning of another, it may be possible to then insert an entirely new and unrelated command that was not intended to be executed. This gives an attacker a privilege or capability that they would not otherwise...

Potential mitigations

Architecture and Design

If at all possible, use library calls rather than external processes to recreate the desired functionality.

Implementation

If possible, ensure that all external commands called from the program are statically created.

ImplementationInput Validation

Assume all input is malicious. Use an accept known good input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, boat may be syntactically valid...

Operation

Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.

System Configuration

Assign permissions that prevent the user from accessing/opening privileged files.