Page History

OS command injection vulnerabilities occur when an application does not fails to sanitize externally obtained input and allows the execution of arbitrary system commands (with carefully chosen arguments) or of an external program.

Noncompliant Code Example

A weakness in a privileged program caused by relying on untrusted sources such as the environment (guideline ENV06-J. Provide a trusted environment and sanitize all inputs) can result in the execution of a command or of a program that has more privileges than beyond those possessed by a typical user. This noncompliant code example shows such a variant of the OS command injection vulnerability.

When the The single argument version of the Runtime.exec() method is invoked, the arguments are parsed by uses a StringTokenizer to parse the argument into separate tokens. Consequently, any command separators maliciously inserted into the argument do not fail to delimit the original command and , so an adversary is unable to proceed with executing execute arbitrary system commands. HoweverNevertheless, this noncompliant code is still vulnerable as an attacker can easily example remains vulnerable, because a lax security policy could permit an attacker to invoke an external (privileged) program, in the presence of a lax security policy.

  
String programName = System.getProperty("program.name");
if (programName != null){ 
  // Runs user controlled program 
  Runtime runtime = Runtime.getRuntime();
  Process proc = runtime.exec(programName); 
}

...

This noncompliant code example demonstrates a less likely, though but more pernicious, form of OS command injection. The program spawns a shell (on POSIX based platforms) or a command prompt (on Windows), and allows permits passing arguments to external programs. Sometimes the The shell or prompt is often used to set an environment variable to a user-defined value from within the Java program. The In this example, the programName string is expected to hold both the program's name , as well as the and its arguments.

An adversary can terminate execute arbitrary commands by terminating the command with a command separator (, such as '&&' and or '||') to execute arbitrary commands. For example, . The attacker can use this technique to cause a denial of service by piping the output of the program can be piped to a sensitive file for the purpose of causing a denial of service, or ; even worse, he can expose sensitive data by redirecting some sensitive output to a non sensitive an insecure location.

  
// programName can be 'ProgramName1 || ProgramName2'  
Process proc = runtime.exec("/bin/sh" + programName);  // "cmd.exe /C" on Windows

Compliant Solution

This compliant solution restricts the programs that a privileged application can invoke when using user controlled inputsprevents command injection by requiring the user to select one of a predefined group of programs or commands. Further, both the programs and their arguments are hard-coded to prevent modification by the user.

Process proc;
int filename = Integer.parseInt(System.getproperty("program.name")); // only allow integer choices
Runtime runtime = Runtime.getRuntime();

switch(filename) {
  case 1: 
    proc = runtime.exec("hardcoded\program1"); 
    break; // Option 1
  case 2: 
    proc = runtime.exec("hardcoded\program2"); 
    break; // Option 2
  default:
    System.out.println("Invalid option!");
    break; 
}

This approach also prevents exposure of the file system structure.

Compliant Solution

An alternative compliant solution is to read the file names from a source existing :

1. Store command names and arguments in a secure directory

...

1. that is inaccessible to an attacker.
2. Use a security manager to regulate both access permissions for that directory and also execute permissions for the commands to be invoked.
3. Use the security manager's checkExec(String cmd) method to check whether the program is permitted to create the subprocess and to execute the external program.

This approach requires that the The security policy file may grant permissions to the application to execute files from a specific directory. The security manager must be used when running the application. (, and that the security policy file cannot be modified by an attacker. Use the security policy file to grant permissions to the application to execute files from a specific directory. See guideline ENV02-J. Create a secure sandbox using a Security Manager.) The security manager's checkExec(String cmd) method allows checking whether the program has the permissions to create the subprocess and execute the external program. for additional information.

The security policy file must grant the {{java.io.FilePermission}} as follows: if {{cmd}} is an absolute path, {{ \[[Permissions 2008|AA. Bibliography#Permissions 08]\]: 

• When cmd is an absolute path, java.io.FilePermission

...

• "

...

• {cmd

...

• }",

...

• "execute"

...

• otherwise, java.io.FilePermission

...

• "-",

...

• "execute";.

Note that the second alternative grants permission to execute any program. Consequently, we strongly recommend that permissions should be restricted per file whenever possible. Do this by specifying absolute paths in the security policy file (the first alternative above). }} \[[Permissions 2008|AA. Bibliography#Permissions 08]\]. However, in the latter case, all programs can be freely executed if the permission is granted. Consequently, permissions should be restricted per file only, by giving absolute paths.

Risk Assessment

OS command injection can cause arbitrary programs to be executed.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

...

This guideline appears in the C++ Secure Coding Standard as ENV03-CPP. Sanitize the environment when invoking external programs.

Bibliography

\[[OWASP 2005|AA. Bibliography#OWASP 05]\] [Reviewing Code for OS Injection|http://www.owasp.org/index.php/Reviewing_Code_for_OS_Injection]
\[[Chess 2007|AA. Bibliography#Chess 07]\] Chapter 5: Handling Input, "Command Injection"
\[[MITRE 2009|AA. Bibliography#MITRE 09]\] [CWE ID 78|http://cwe.mitre.org/data/definitions/78.html] "Failure to Preserve OS Command Structure (aka 'OS Command Injection')"
\[[OWASP 2005|AA. Bibliography#OWASP 05]\] [Reviewing Code for OS Injection|http://www.owasp.org/index.php/Reviewing_Code_for_OS_Injection]
\[[Permissions 2008|AA. Bibliography#Permissions 08]\] [Permissions in the Java™ SE 6 Development Kit (JDK)|http://java.sun.com/javase/6/docs/technotes/guides/security/permissions.html], Sun Microsystems, Inc. (2008)

...

IDS05-J. Library methods should validate their parameters      13. Input Validation and Data Sanitization (IDS)      IDS07-J. Prevent SQL Injection