Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Opis

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Skutki

• Confidentiality

  Read Application Data

  Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.

• Access Control

  Bypass Protection Mechanism

  In some cases, injectable code controls authentication; this may lead to a remote vulnerability.

• Other

  Alter Execution Logic

  Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.

• Integrity, Other

  Other

  Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.

• Non-Repudiation

  Hide Activities

  Often the actions performed by injected control code are unlogged.

Zapobieganie

• Requirements

  Programming languages and supporting technologies might be chosen which are not subject to these issues.

• Implementation

  Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

Przykłady podatności

• CVE-2024-5184 API service using a large generative AI model allows direct prompt injection to leak hard-coded system prompts or execute other prompts.
• CVE-2022-36069 Python-based dependency management tool avoids OS command injection when generating Git commands but allows injection of optional arguments with input beginning with a dash (CWE-88), potentially allowing for code execution.
• CVE-1999-0067 Canonical example of OS command injection. CGI program does not neutralize "|" metacharacter when invoking a phonebook program.
• CVE-2022-1509 injection of sed script syntax ("sed injection")
• CVE-2020-9054 Chain: improper input validation (CWE-20) in username parameter, leading to OS command injection (CWE-78), as exploited in the wild per CISA KEV.
• CVE-2021-44228 Product does not neutralize ${xyz} style expressions, allowing remote code execution. (log4shell vulnerability)

Słabość nadrzędna

• CWE-707 Improper Neutralization

Słabości podrzędne

• CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
• CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
• CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
• CWE-91 XML Injection (aka Blind XPath Injection)
• CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
• CWE-94 Improper Control of Generation of Code ('Code Injection')
• CWE-99 Improper Control of Resource Identifiers ('Resource Injection')
• CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
• CWE-943 Improper Neutralization of Special Elements in Data Query Logic
• CWE-1236 Improper Neutralization of Formula Elements in a CSV File

Kiedy powstaje

• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific

Uwagi

For many years, there have been significant subtree overlap challenges between CWE-138 (and descendants) and CWE-74 (and descendants) due to variances in the "facets" or "dimensions" of abstraction. Under CWE-138, entries are hierarchically organized around the "type of special element" that is not neutralized. Under CWE-74, hierarchical organization is around the "type of data/command" that is affected. This multi-faceted challenge will require extensive research and significant changes that have not been able to be resolved as of CWE 4.19.

Software or other automated logic has certain assumptions about what constitutes data and control respectively. It is the lack of verification of these assumptions for user-controlled input that leads to injection problems. This means that the execution of the component may be altered through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed.

Many people treat injection only as an input validation problem (CWE-20) because many people do not distinguish between the consequence/attack (injection) and the protection mechanism that prevents the attack from succeeding. However, input validation is only one potential protection mechanism (output encoding is another), and there is a chaining relationship between improper input validation and the improper enforcement of the structure of messages to other components. Other issues not directly related to input validation, such as race conditions, could similarly impact message structure.

Źródła

1. The CLASP Application Security Process — Secure Software, Inc., 2005
2. Google & Apache Found Vulnerable to GitHub Environment Injection — Noam Dotan, 2022