Page History

...

Every Java application has a single instance of class Runtime that allows the application to interface with the environment in which the application is running. The current runtime can be obtained from the getRuntime() method. The semantics of Runtime.exec are poorly defined, so it's best not to rely on its behavior any more than necessary. It will invoke the command directly without a shell. If you want a shell, you can use "/bin/sh", "-c" on UNIX POSIX or "cmd.exe" on Windows. The variants of exec()( that take the command line a single String split it with a StringTokenizer. On Windows, these tokens will be are concatenated back into a single argument string somewhere along the linebefore being executed.

Consequently, command injection doesn't work unless a command interpreter is explicitly invoked. However, particularly on Windows, there can be vulnerabilities where arguments have spaces, double quotes, etc.and so forth, or start with a - or / to indicate a switch.

This is a specific instance of the guideline IDS01-J. Sanitize data passed across a trust boundary. Any string data that originates from outside the program's trust boundary must be sanitized before being executed as a command on the current platform.

...

This noncompliant code example provides a listing of the directory that is provided by directory listing using the dir system property command. It accomplishes this by using Runtime.exec() to invoke the Windows dir command.

  
import java.io.InputStream;

class DirList {

  public static void main(String[] args) throws Exception {
    String dir = System.getProperty("dir");
    Runtime rt = Runtime.getRuntime();
    Process proc = rt.exec("cmd.exe /C dir " + dir);
    int result = proc.waitFor();
    if (result != 0) {
      System.out.println("process error: " + result);
    }
    InputStream in = (result == 0) ? proc.getInputStream() : proc.getErrorStream();
    int c;
    while ((c = in.read()) != -1) {
      System.out.print((char) c);
    }
  }
}

Since Because Runtime.exec() receives unsanitized data originating from the environment (see guideline ENV06-J. Provide a trusted environment and sanitize all inputs), this code is susceptible to a command injection attack.

...

This compliant solution sanitizes the folder untrusted user input by permitting only a handful of correct characters to appear.

...

Although this is a compliant solution, the sanitization method is weak because it will reject valid directories. Also since , because the command interpreter invoked is system dependent, it is difficult to say that this solution will not allow command injection on every possible platform in which a Java program might run.

Compliant Solution (Restricted

...

User Choice)

This compliant solution prevents command injection by only passing trusted strings to Runtime.exec(). While the user has control over which string gets used, the user cannot send strings directly to Runtime.exec().

...

import java.io.File;

class DirList {
  public static void main(String[] args) throws Exception {
    File dir = new File(System.getProperty("dir"));
    if (!dir.isDirectory()) {
      System.out.println("Not a directory");
    } else {
      for (String file : dir.list()) {
        System.out.println(file);
      }
    }
  }
}

Risk Assessment

OS command injection can cause arbitrary programs to be executedPass untrusted, unsanitized data to the Runtime.exec() method can result in command and argument injection attacks.

Related Vulnerabilities

Examples of related vulnerabilities include:

• CVE-2010-0886 : Sun Java Web Start Plugin Command Line Argument Injection
• CVE-2010-1826 Command injection in updateSharingD's handling of Mach RPC messages
• T-472: Mac OS X Java Command Injection Flaw in updateSharingD Lets Local Users Gain Elevated Privileges

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

...