CWE-96Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

Description

Common consequences· 5

• Confidentiality — Read Files or Directories, Read Application Data
  The injected code could access restricted data / files.
• Access Control — Bypass Protection Mechanism
  In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
• Access Control — Gain Privileges or Assume Identity
  Injected code can access resources that the attacker is directly prevented from accessing.
• Integrity / Confidentiality / Availability / Other — Execute Unauthorized Code or Commands
  Code injection attacks can lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing. Additionally, code injection can often result in the execution of arbitrary code.
• Non-Repudiation — Hide Activities
  Often the actions performed by injected control code are unlogged.

Potential mitigations· 2

• [Implementation]
• [Implementation]Perform proper output validation and escaping to neutralize all code syntax from data written to code files.

Related CAPEC attack patterns· 5

Exploits (incoming)5

(incoming)2

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.