CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')

Description

Common consequences· 1

• Integrity / Confidentiality / Availability — Execute Unauthorized Code or Commands
  If a malicious user injects a character (such as a semi-colon) that delimits the end of one command and the beginning of another, it may be possible to then insert an entirely new and unrelated command that was not intended to be executed. This gives an attacker a privilege or capability that they would not otherwise have.

Potential mitigations· 5

• [Architecture and Design]If at all possible, use library calls rather than external processes to recreate the desired functionality.
• [Implementation]If possible, ensure that all external commands called from the program are statically created.
• [Implementation]
• [Operation]Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
• [System Configuration]Assign permissions that prevent the user from accessing/opening privileged files.

Related CAPEC attack patterns· 8

Exploits (incoming)7

Compliance frameworks addressing this (incoming)1

(incoming)142

Showing top 30 of 142 by confidence. Click any target to see the full neighbourhood.

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.