Skip to main content

Remote command execution

Description​

The system builds OS commands using inputs that can be manipulated externally, it does not correctly neutralize special elements that could modify the OS command.

Impact​

Execute unauthorized code or commands.

Recommendation​

  • If at all possible, use standard library calls rather than external processes to recreate the desired functionality.
  • Keep as much data as possible used to generate command outside of external control.
  • Properly escape the arguments used to generate the command and avoid special characters.

Threat​

Authenticated attacker from the Internet.

Expected Remediation Time​

⌚ 30 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base​

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: N
  • User interaction: N
  • Scope: C
  • Confidentiality: H
  • Integrity: H
  • Availability: H

Temporal​

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result​

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:X
  • Score:
    • Base: 10.0
    • Temporal: 10.0
  • Severity:
    • Base: Critical
    • Temporal: Critical

Code Examples​

Compliant code​

private void goodG2B() throws Throwable
{
  String data;
  /* FIX: Use a hardcoded string */
  data = "foo";
  String osCommand;
  if(System.getProperty("os.name").toLowerCase().indexOf("win") >= 0){
    /* running on Windows */
    osCommand = "c:\WINDOWS\SYSTEM32\cmd.exe /c dir ";
  }
  else{
    /* running on non-Windows */
    osCommand = "/bin/ls ";
  }

  /* POTENTIAL FLAW: command injection */
  Process process = Runtime.getRuntime().exec(osCommand + data);
  process.waitFor();
}

Source Code: https://raw.githubusercontent.com/find-sec-bugs/juliet-test-suite/master/src/testcases/CWE78_OS_Command_Injection/CWE78_OS_Command_Injection__Environment_01.java

Non compliant code​

public void bad() throws Throwable{
  String data;
  /* POTENTIAL FLAW: Read data from an environment variable */
  data = System.getenv("ADD");

  String osCommand;
  if(System.getProperty("os.name").toLowerCase().indexOf("win") >= 0){
    osCommand = "c:\WINDOWS\SYSTEM32\cmd.exe /c dir ";
  }
  else{
    osCommand = "/bin/ls ";
  }

  /* POTENTIAL FLAW: command injection */
  Process process = Runtime.getRuntime().exec(osCommand + data);
  process.waitFor();
}

Requirements​

free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.