SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

Versions Compared

Old Version 64

changes.mady.by.user Robert Seacord (Manager)

Saved on

compared with

New Version 65

changes.mady.by.user Robert Seacord (Manager)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

External programs are commonly invoked to perform a function required by the overall system. This is a form of reuse and might even be considered a crude form of component-based software engineering. Command and argument injection vulnerabilities occur when an application fails to sanitize untrusted input and uses it in the execution of external programs.

Every Java application has a single instance of class Runtime that allows the application to interface with the environment in which the application is running. The current runtime can be obtained from the getRuntime() method. The semantics of Runtime.exec are poorly defined, so it's best not to rely on its behavior any more than necessary. It will invoke the command directly without a shell. If you want a shell, you can use "/bin/sh", "-c" on UNIX or "cmd.exe" on Windows. The variants of exec)( that take the command line a single String split it with a StringTokenizer. On Windows, these tokens will be concatenated back into a single argument string somewhere along the line.

Consequently, command injection doesn't work unless a command interpreter is explicitly invoked. However, particularly on Windows, there can be vulnerabilities where arguments have spaces, double quotes, etc., in or start with a - or / to indicate a switch.

This is a specific instance of the guideline IDS01-J. Sanitize data passed across a trust boundary. Any string data that originates from outside the program's trust boundary must be sanitized before being executed as a command on the current platform.

Noncompliant Code Example

A weakness in a privileged program caused by relying on untrusted sources such as the environment (see guideline ENV06-J. Provide a trusted environment and sanitize all inputs) can result in the execution of a command or of a program that has privileges beyond those possessed by a typical user.

This noncompliant code example attempts to send a message to an email address supplied by an untrusted user. Because untrusted data originating from the environment (see guideline ENV06-J. Provide a trusted environment and sanitize all inputs) without sanitization this code is susceptible to a command injection attack.

Code Block
bgColor#FFcccc
Wiki Markup
Every Java application has a single instance of class {{Runtime}} that allows the application to interface with the environment in which the application is running. The current runtime can be obtained from the {{getRuntime()}} method. The {{exec()}} method executes the specified string command by invoking an implementation-defined command processor, such as a UNIX shell or {{CMD.EXE}} in Windows NT and later.

External programs are commonly invoked to perform a function required by the overall system. This is a form of reuse and might even be considered a crude form of component-based software engineering.

Command interpreters, such as the POSIX command-language interpreter {{sh}} and the Windows {{CMD.EXE}}, however, provide functionality in addition to executing a simple command.

OS command injection vulnerabilities occur when an application fails to sanitize untrusted input and uses it in the execution of arbitrary system commands (with carefully chosen arguments) or of an external program.  This is a specific instance of the guideline [IDS01-J. Sanitize data passed across a trust boundary]. Any string data that originates from outside the program's trust boundary must be sanitized before being executed as a command on the current platform.

h2. Noncompliant Code Example

A weakness in a privileged program caused by relying on untrusted sources such as the environment (see guideline [ENV06-J. Provide a trusted environment and sanitize all inputs]) can result in the execution of a command or of a program that has privileges beyond those possessed by a typical user.

This noncompliant code example attempts to send a message to an email address supplied by an untrusted user. Because untrusted data originating from the environment (see guideline [ENV06-J. Provide a trusted environment and sanitize all inputs]) without sanitization this code is susceptible to a command injection attack.

{code:bgColor=#FFcccc}  
String address = System.getProperty("email");
if (address == null) {
  // handle error
}

Runtime runtime = Runtime.getRuntime();
Process proc = runtime.exec("mail " + address); 
{code}

If

...

an

...

attacker

...

supplies

...

the

...

following

...

value

...

for

...

the

...

"email"

...

environment

...

variable:

{
Code Block
}
noboday@nowhere.com ; useradd attacker
{code}

the

...

command

...

executed

...

is

...

actually

...

two

...

commands:

{
Code Block
}
mail noboday@nowhere.com ;
useradd attacker
{code}

which

...

causes

...

a

...

new

...

account

...

to

...

be

...

created

...

for

...

the

...

attacker.

...

Compliant

...

Solution

...

(Sanitization)

...

This

...

compliant

...

solution

...

sanitizes

...

the

...

email

...

address

...

by

...

permitting

...

only

...

a

...

handful

...

of

...

correct

...

characters

...

to

...

appear.

Code Block
bgColor#ccccff
 

{code:bgColor=#ccccff}
String address = System.getProperty("email");
if (address == null) {
  // handle error
}
if (!Pattern.matches("[0-9A-Za-z@.]+", address)) {
  // Handle error
}

Runtime runtime = Runtime.getRuntime();
Process proc = runtime.exec("mail " + address); 
{code}

Although

...

this

...

is

...

a

...

compliant

...

solution,

...

the

...

sanitization

...

method

...

is

...

weak

...

because:

...

  • it

...

  • will

...

  • reject

...

  • valid

...

  • email

...

  • addresses

...

  • it

...

  • doesn't

...

  • require

...

  • any

...

  • syntax

...

  • or

...

  • regular

...

  • expression

...

  • pattern

...

  • matching

...

  • (for

...

  • example,

...

  • using

...

  • the

...

  • regular

...

  • expression

...

  • Code Block
    "\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b")

...

  •  to 
...
  •  validate 
...
  •  the 
...
  •  input.
...
  • email 
...
  •  validation 
...
  •  is 
...
  •  complicated. 
...
  •  You 
...
  •  can 
...
  •  actually 
...
  •  purchase 
...
  •  or 
...
  •  acquire 
...
  •  an 
...
  •  entire 
...
  •  component 
...
  •  / 
...
  •  subsystem 
...
  •  for 
...
  •  email 
...
  •  address 
...
  •  validation, 
...
  •  for 
...
  •  example 
...
  •  the 
...
  •  Apache 
...
  •  Class EmailValidator
  • The command interpreter invoked is system dependent, so is difficult to say that this solution will not allow command injection in every environment in which a Java program might run.
Compliant Solution (Parametrization)
A further improvement to the previous compliant solution is to parametrize the call to the exec() method. There are six forms of the exec() method, most of which are convenience methods for the following method: 
 Code Block
 EmailValidator|http://commons.apache.org/validator/api-1.3.1/org/apache/commons/validator/EmailValidator.html]}} 
* The command interpreter invoked is system dependent, so is difficult to say that this solution will not allow command injection in every environment in which a Java program might run.

h2. Compliant Solution (Parametrization)

A further improvement to the previous compliant solution is to parametrize the call to the {{exec()}} method. There are six forms of the {{exec()}} method, most of which are convenience methods for the following method:  

{code}
 public Process exec(String[] cmdarray,
                    String[] envp,
                    File dir)
             throws IOException
{code}


Using 
...
 any 
...
 form 
...
 of 
...
 the 
...
exec()
...
 method 
...
 where 
...
 the 
...
 first 
...
 argument 
...
 is 
...
 an 
...
 array 
...
 containing 
...
 the 
...
 command 
...
 to 
...
 call 
...
 and 
...
 its 
...
 arguments 
...
 is 
...
 generally 
...
 safer 
...
 because 
...
 the 
...
 command 
...
 itself 
...
 does 
...
 not 
...
 contain 
...
 untrusted 
...
 data. 
 Code Block
bgColor#ccccff
  

{code:bgColor=#ccccff}
String address = System.getProperty("email");
if (address == null) {
  // handle error
}
if (!Pattern.matches("[0-9A-Za-z@.]+", address)) {
  // Handle error
}

String[] command = {"mail", address};
Runtime runtime = Runtime.getRuntime();
Process proc = runtime.exec(command, null, null); 
{code}


In 
...
 some 
...
 cases, 
...
 this 
...
 can 
...
 still 
...
 result 
...
 in 
...
 an 
...
 argument 
...
 injection 
...
 attack.
...
Compliant 
...
 Solution 
...
 (Not 
...
 passing 
...
 untrusted 
...
 data 
...
 to 
...
 the 
...
exec()
...
 method)
...
This 
...
 compliant 
...
 solution 
...
 prevents 
...
 command 
...
 injection 
...
 by 
...
 requiring 
...
 the 
...
 user 
...
 to 
...
 select 
...
 one 
...
 of 
...
 a 
...
 predefined 
...
 group 
...
 of 
...
 addresses. 
...
 This 
...
 prevents 
...
 untrusted 
...
 data 
...
 from 
...
 being 
...
 added 
...
 to 
...
 the 
...
 command.


{:=
 Code Block
bgColor
#ccccff
}
String address = null;

int filename = Integer.parseInt(System.getproperty("address")); // only allow integer choices
switch(filename) {
  case 1: 
    address = "root@localhost"
    break; // Option 1
  case 2: 
    address = "postmaster@localhost"
    break; // Option 2
  default: // invalid
    break; 
}
if (address == null) {
  // handle error
}

Runtime runtime = Runtime.getRuntime();
Process proc = runtime.exec("mail " + address); 
{code}


This 
...
 compliant 
...
 solution 
...
 hard 
...
 codes 
...
 the 
...
 email 
...
 addresses 
...
 which 
...
 becomes 
...
 unmanageable 
...
 if 
...
 you 
...
 have 
...
 many 
...
 email 
...
 addresses. 
...
 A 
...
 more 
...
 extensible 
...
 solution 
...
 is 
...
 to 
...
 read 
...
 all 
...
 the 
...
 email 
...
 addresses 
...
 from 
...
 a 
...
 properties 
...
 file 
...
 into 
...
 a 
...
java.util.Properties
...
 object.
...
Risk Assessment
OS command injection can cause arbitrary programs to be executed.
 Guideline 
 Severity 
 Likelihood 
 Remediation Cost 
 Priority 
 Level 
 IDS06-J 
 high 
 probable 
 medium 
 P12 
 L1 
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this guideline on the CERT website.
Bibliography
 Wiki Markup
\[[Chess 2007|AA. Bibliography#Chess 07]\] Chapter 5: Handling Input, "Command Injection"
\[[MITRE 2009|AA. Bibliography#MITRE 09]\] [CWE ID 78|http://cwe.mitre.org/data/definitions/78.html] "Failure to Preserve OS Command Structure (aka 'OS Command Injection')"
\[[OWASP 2005|AA. Bibliography#OWASP 05]\] [Reviewing Code for OS Injection|http://www.owasp.org/index.php/Reviewing_Code_for_OS_Injection]
\[[Permissions 2008|AA. Bibliography#Permissions 08]\] [Permissions in the Java™ SE 6 Development Kit (JDK)|http://java.sun.com/javase/6/docs/technotes/guides/security/permissions.html], Sun Microsystems, Inc. (2008)
...
...
IDS05-J. 
...
 Library 
...
 methods 
...
 should 
...
 validate 
...
 their 
...
parameters      13. Input Validation and Data Sanitization (IDS)      IDS07-J. 
...
 Prevent 
...
 SQL 
...
 Injection
...