CWE-94Improper Control of Generation of Code ('Code Injection')

Description

Common consequences· 4

• Access Control — Bypass Protection Mechanism
  In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
• Access Control — Gain Privileges or Assume Identity
  Injected code can access resources that the attacker is directly prevented from accessing.
• Integrity / Confidentiality / Availability — Execute Unauthorized Code or Commands
  When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. As a result, code injection can often result in the execution of arbitrary code. Code injection attacks can also lead to loss of data integrity in nearly all cases, since the control-plane data injected is always incidental to data recall or writing.
• Non-Repudiation — Hide Activities
  Often the actions performed by injected control code are unlogged.

Potential mitigations· 5

• [Architecture and Design]Refactor your program so that you do not have to dynamically generate code.
• [Architecture and Design]
• [Implementation]
• [Testing]Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
• [Operation]Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Related CAPEC attack patterns· 3

Exploits (incoming)3

Compliance frameworks addressing this (incoming)3

(incoming)144

Showing top 30 of 144 by confidence. Click any target to see the full neighbourhood.

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.