Improper Neutralization of Special Elements used in a Command ('Command Injection')

Opis

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.

Inne nazwy

Command injection

an attack-oriented phrase for this weakness. Note: often used when "OS command injection" (CWE-78) was intended.

Skutki

• Integrity, Confidentiality, Availability

  Execute Unauthorized Code or Commands

  If a malicious user injects a character (such as a semi-colon) that delimits the end of one command and the beginning of another, it may be possible to then insert an entirely new and unrelated command that was not intended to be executed. This gives an attacker a privilege or capability that they would not otherwise have.

Zapobieganie

• Architecture and Design

  If at all possible, use library calls rather than external processes to recreate the desired functionality.

• Implementation

  If possible, ensure that all external commands called from the program are statically created.

• Implementation · Input Validation

  Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

  When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

  Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

• Operation

  Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.

• System Configuration

  Assign permissions that prevent the user from accessing/opening privileged files.

Przykłady podatności

• CVE-2022-1509 injection of sed script syntax ("sed injection")
• CVE-2024-5184 API service using a large generative AI model allows direct prompt injection to leak hard-coded system prompts or execute other prompts.
• CVE-2020-11698 anti-spam product allows injection of SNMP commands into confiuration file
• CVE-2019-12921 image program allows injection of commands in "Magick Vector Graphics (MVG)" language.
• CVE-2022-36069 Python-based dependency management tool avoids OS command injection when generating Git commands but allows injection of optional arguments with input beginning with a dash (CWE-88), potentially allowing for code execution.
• CVE-1999-0067 Canonical example of OS command injection. CGI program does not neutralize "|" metacharacter when invoking a phonebook program.
• CVE-2020-9054 Chain: improper input validation (CWE-20) in username parameter, leading to OS command injection (CWE-78), as exploited in the wild per CISA KEV.
• CVE-2021-41282 injection of sed script syntax ("sed injection")
• CVE-2019-13398 injection of sed script syntax ("sed injection")

Słabość nadrzędna

• CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Słabości podrzędne

• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
• CWE-624 Executable Regular Expression Error
• CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
• CWE-1427 Improper Neutralization of Input Used for LLM Prompting

Kiedy powstaje

• Implementation — Command injection vulnerabilities typically occur when: 1. Data enters the application from an untrusted source. 1. The data is part of a string that is executed as a command by the application.
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific, AI/ML

Uwagi

The "command injection" phrase carries different meanings, either as an attack or as a technical impact. The most common usage of "command injection" refers to the more-accurate OS command injection (CWE-78), but there are many command languages.

In vulnerability-focused analysis, the phrase may refer to any situation in which the adversary can execute commands of their own choosing, i.e., the focus is on the risk and/or technical impact of exploitation. Many proof-of-concept exploits focus on the ability to execute commands and may emphasize "command injection." However, there are dozens of weaknesses that can allow execution of commands. That is, the ability to execute commands could be resultant from another weakness.

To some, "command injection" can include cases in which the functionality intentionally allows the user to specify an entire command, which is then executed. In this case, the root cause weakness might be related to missing or incorrect authorization, since an adversary should not be able to specify arbitrary commands, but some users or admins are allowed.

CWE-77 and its descendants are specifically focused on behaviors in which the product is intentionally building a command to execute, and the adversary can inject separators into the command or otherwise change the command being executed.

Command injection is a common problem with wrapper programs.

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005
2. Exploiting Software: How to Break Code — Greg Hoglund, Gary McGraw, Addison-Wesley, 2004
3. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 10: Command Injection." Page 171, McGraw-Hill, 2010
4. Supplemental Details - 2022 CWE Top 25 — MITRE, Details of Problematic Mappings, 2022