CWE-77 在命令中使用的特殊元素转义处理不恰当（命令注入）

Improper Neutralization of Special Elements used in a Command ('Command Injection')

结构: Simple

Abstraction: Class

状态: Draft

被利用可能性: High

基本描述

The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

扩展描述

Command injection vulnerabilities typically occur when:

Command injection is a common problem with wrapper programs.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 74 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 74 cwe_View_ID: 699 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

可能的缓解方案

Architecture and Design

策略:

If at all possible, use library calls rather than external processes to recreate the desired functionality.

Implementation

策略:

If possible, ensure that all external commands called from the program are statically created.

MIT-5 Implementation

策略: Input Validation

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a whitelist of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs (i.e., do not rely on a blacklist). A blacklist is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, blacklists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

Operation

策略:

Run time: Run time policy enforcement may be used in a whitelist fashion to prevent use of any non-sanctioned commands.

System Configuration

策略:

Assign permissions to the software system that prevents the user from accessing/opening privileged files.

示例代码

例

The following simple program accepts a filename as a command line argument and displays the contents of the file back to the user. The program is installed setuid root because it is intended for use as a learning tool to allow system administrators in-training to inspect privileged system files without giving them the ability to modify them or damage the system.

bad C

Because the program runs with root privileges, the call to system() also executes with root privileges. If a user specifies a standard filename, the call works as expected. However, if an attacker passes a string of the form ";rm -rf /", then the call to system() fails to execute cat due to a lack of arguments and then plows on to recursively delete the contents of the root partition.

Note that if argv[1] is a very long argument, then this issue might also be subject to a buffer overflow (CWE-120).

例

The following code is from an administrative web application designed to allow users to kick off a backup of an Oracle database using a batch-file wrapper around the rman utility and then run a cleanup.bat script to delete some temporary files. The script rmanDB.bat accepts a single command line parameter, which specifies what type of backup to perform. Because access to the database is restricted, the application runs the backup as a privileged user.

bad Java

The problem here is that the program does not do any validation on the backuptype parameter read from the user. Typically the Runtime.exec() function will not execute multiple commands, but in this case the program first runs the cmd.exe shell in order to run multiple commands with a single call to Runtime.exec(). Once the shell is invoked, it will happily execute multiple commands separated by two ampersands. If an attacker passes a string of the form "& del c:dbms.", then the application will execute this command along with the others specified by the program. Because of the nature of the application, it runs with the privileges necessary to interact with the database, which means whatever command the attacker injects will run with those privileges as well.

例

The following code from a system utility uses the system property APPHOME to determine the directory in which it is installed and then executes an initialization script based on a relative path from the specified directory.

bad Java

The code above allows an attacker to execute arbitrary commands with the elevated privilege of the application by modifying the system property APPHOME to point to a different path containing a malicious version of INITCMD. Because the program does not validate the value read from the environment, if an attacker can control the value of the system property APPHOME, then they can fool the application into running malicious code and take control of the system.

例

The following code is a wrapper around the UNIX command cat which prints the contents of a file to standard out. It is also injectable:

bad C

Used normally, the output is simply the contents of the file requested:

informative

However, if we add a semicolon and another command to the end of this line, the command is executed by catWrapper with no complaint:

attack

If catWrapper had been set to have a higher privilege level than the standard user, arbitrary commands could be executed with that higher privilege.

Notes

分类映射

相关攻击模式

• CAPEC-136
• CAPEC-15
• CAPEC-183
• CAPEC-248
• CAPEC-40
• CAPEC-43
• CAPEC-75
• CAPEC-76

引用

• REF-140 Exploiting Software: How to Break Code

• REF-44 24 Deadly Sins of Software Security

文章来源于互联网:scap中文网