Tag Archives: CVE-2008-5071

CWE-94 – Improper Control of Generation of Code (‘Code Injection’)

Read Time:3 Minute, 15 Second

Description

The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Modes of Introduction:

– Architecture and Design

Likelihood of Exploit: Medium

 

Related Weaknesses

CWE-74
CWE-74
CWE-913
CWE-691

 

Consequences

Access Control: Bypass Protection Mechanism

In some cases, injectable code controls authentication; this may lead to a remote vulnerability.

Access Control: Gain Privileges or Assume Identity

Injected code can access resources that the attacker is directly prevented from accessing.

Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands

Code injection attacks can lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing. Additionally, code injection can often result in the execution of arbitrary code.

Non-Repudiation: Hide Activities

Often the actions performed by injected control code are unlogged.

 

Potential Mitigations

Phase: Architecture and Design

Effectiveness:

Description: 

Refactor your program so that you do not have to dynamically generate code.

Phase: Architecture and Design

Effectiveness:

Description: 

Phase: Implementation

Effectiveness:

Description: 

Phase: Testing

Effectiveness:

Description: 

Use automated static analysis tools that target this type of weakness. Many modern techniques use data flow analysis to minimize the number of false positives. This is not a perfect solution, since 100% accuracy and coverage are not feasible.

Phase: Testing

Effectiveness:

Description: 

Use dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The software’s operation may slow down, but it should not become unstable, crash, or generate incorrect results.

Phase: Operation

Effectiveness:

Description: 

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl’s “-T” switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Phase: Operation

Effectiveness:

Description: 

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl’s “-T” switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

CVE References

 

  • CVE-2008-5305
    • Eval injection in Perl program using an ID that should only contain hyphens and numbers.
  • CVE-2005-1921
    • MFV. code injection into PHP eval statement using nested constructs that should not be nested.
  • CVE-2005-2498
    • MFV. code injection into PHP eval statement using nested constructs that should not be nested.
  • CVE-2005-3302
    • Code injection into Python eval statement from a field in a formatted file.
  • CVE-2001-1471
    • chain: Resultant eval injection. An invalid value prevents initialization of variables, which can be modified by attacker and later injected into PHP eval statement.
  • CVE-2002-0495
    • Perl code directly injected into CGI library file from parameters to another CGI program.
  • CVE-2005-1876
    • Direct PHP code injection into supporting template file.
  • CVE-2005-1894
    • Direct code injection into PHP script that can be accessed by attacker.
  • CVE-2003-0395
    • PHP code from User-Agent HTTP header directly inserted into log file implemented as PHP script.

CWE-95 – Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’)

Read Time:1 Minute, 57 Second

Description

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. “eval”).

This may allow an attacker to execute arbitrary code, or at least modify what code can be executed.

Modes of Introduction:

– Architecture and Design

Likelihood of Exploit: Medium

 

Related Weaknesses

CWE-94

 

Consequences

Confidentiality: Read Files or Directories, Read Application Data

The injected code could access restricted data / files.

Access Control: Bypass Protection Mechanism

In some cases, injectable code controls authentication; this may lead to a remote vulnerability.

Access Control: Gain Privileges or Assume Identity

Injected code can access resources that the attacker is directly prevented from accessing.

Integrity, Confidentiality, Availability, Other: Execute Unauthorized Code or Commands

Code injection attacks can lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing. Additionally, code injection can often result in the execution of arbitrary code.

Non-Repudiation: Hide Activities

Often the actions performed by injected control code are unlogged.

 

Potential Mitigations

Phase: Architecture and Design, Implementation

Effectiveness:

Description: 

If possible, refactor your code so that it does not need to use eval() at all.

Phase: Implementation

Effectiveness:

Description: 

Phase: Implementation

Effectiveness:

Description: 

CVE References

 

  • CVE-2008-5305
    • Eval injection in Perl program using an ID that should only contain hyphens and numbers.
  • CVE-2005-1921
    • MFV. code injection into PHP eval statement using nested constructs that should not be nested.
  • CVE-2005-2498
    • MFV. code injection into PHP eval statement using nested constructs that should not be nested.
  • CVE-2005-3302
    • Code injection into Python eval statement from a field in a formatted file.
  • CVE-2001-1471
    • chain: Resultant eval injection. An invalid value prevents initialization of variables, which can be modified by attacker and later injected into PHP eval statement.
  • CVE-2007-2713
    • Chain: Execution after redirect triggers eval injection.