Description
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit: Medium
Related Weaknesses
Consequences
Access Control: Bypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
Access Control: Gain Privileges or Assume Identity
Injected code can access resources that the attacker is directly prevented from accessing.
Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands
Code injection attacks can lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing. Additionally, code injection can often result in the execution of arbitrary code.
Non-Repudiation: Hide Activities
Often the actions performed by injected control code are unlogged.
Potential Mitigations
Phase: Architecture and Design
Effectiveness:
Description:
Refactor your program so that you do not have to dynamically generate code.
Phase: Architecture and Design
Effectiveness:
Description:
Phase: Implementation
Effectiveness:
Description:
Phase: Testing
Effectiveness:
Description:
Use automated static analysis tools that target this type of weakness. Many modern techniques use data flow analysis to minimize the number of false positives. This is not a perfect solution, since 100% accuracy and coverage are not feasible.
Phase: Testing
Effectiveness:
Description:
Use dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The software’s operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Phase: Operation
Effectiveness:
Description:
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl’s “-T” switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Phase: Operation
Effectiveness:
Description:
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl’s “-T” switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
CVE References
- CVE-2008-5071
- Eval injection in PHP program.
- CVE-2002-1750
- Eval injection in Perl program.
- CVE-2008-5305
- Eval injection in Perl program using an ID that should only contain hyphens and numbers.
- CVE-2002-1752
- Direct code injection into Perl eval function.
- CVE-2002-1753
- Eval injection in Perl program.
- CVE-2005-1527
- Direct code injection into Perl eval function.
- CVE-2005-2837
- Direct code injection into Perl eval function.
- CVE-2005-1921
- MFV. code injection into PHP eval statement using nested constructs that should not be nested.
- CVE-2005-2498
- MFV. code injection into PHP eval statement using nested constructs that should not be nested.
- CVE-2005-3302
- Code injection into Python eval statement from a field in a formatted file.
- CVE-2007-1253
- Eval injection in Python program.
- CVE-2001-1471
- chain: Resultant eval injection. An invalid value prevents initialization of variables, which can be modified by attacker and later injected into PHP eval statement.
- CVE-2002-0495
- Perl code directly injected into CGI library file from parameters to another CGI program.
- CVE-2005-1876
- Direct PHP code injection into supporting template file.
- CVE-2005-1894
- Direct code injection into PHP script that can be accessed by attacker.
- CVE-2003-0395
- PHP code from User-Agent HTTP header directly inserted into log file implemented as PHP script.