Page History

class DirList {
  public static void main(String[] args) throws Exception {
    String dir

Every Java application has a single instance of class {{Runtime}} that allows the application to interface with the environment in which the application is running. The current runtime can be obtained from the {{getRuntime()}} method. The {{exec()}} method executes the specified string command by invoking an implementation-defined command processor, such as a UNIX shell or {{CMD.EXE}} in Windows NT and later.

External programs are commonly invoked to perform a function required by the overall system. This is a form of reuse and might even be considered a crude form of component-based software engineering.

Command interpreters, such as the POSIX command-language interpreter {{sh}} and the Windows {{CMD.EXE}}, however, provide functionality in addition to executing a simple command.

OS command injection vulnerabilities occur when an application fails to sanitize untrusted input and uses it in the execution of arbitrary system commands (with carefully chosen arguments) or of an external program.  This is a specific instance of the guideline [IDS01-J. Sanitize data passed across a trust boundary]. Any string data that originates from outside the program's trust boundary must be sanitized before being executed as a command on the current platform.

h2. Noncompliant Code Example

A weakness in a privileged program caused by relying on untrusted sources such as the environment (see guideline [ENV06-J. Provide a trusted environment and sanitize all inputs]) can result in the execution of a command or of a program that has privileges beyond those possessed by a typical user.

This noncompliant code example attempts to send a message to an email address supplied by an untrusted user. Because untrusted data originating from the environment (see guideline [ENV06-J. Provide a trusted environment and sanitize all inputs]) without sanitization this code is susceptible to a command injection attack.

{code:bgColor=#FFcccc}  
String address = System.getProperty("emaildir");
if (address == null) {
  // handle error
}

Runtime runtimert = Runtime.getRuntime();
    Process proc = runtimert.exec("mailcmd.exe /C dir " + addressdir); 
{code}

If an attacker supplies the following valueint forresult the {{"email"}} environment variable:

{code}
noboday@nowhere.com ; useradd attacker
{code}

the command executed is actually two commands:

{code}
mail noboday@nowhere.com ;
useradd attacker
{code}

which causes a new account to be created for the attacker.

h2. Compliant Solution (Sanitization)

This compliant solution sanitizes the email address by permitting only a handful of correct characters to appear. 

{code:bgColor=#ccccff}
String address = System.getProperty("email");
if (address == null) {
  // handle error
}
if (!Pattern.matches("[0-9A-Za-z@.]+", address)) {
  // Handle error
}

Runtime runtime = Runtime.getRuntime();
Process proc = runtime.exec("mail " + address); 
{code}

Although this is a compliant solution, the sanitization method is weak because:
* it will reject valid email addresses
* it doesn't require any syntax or regular expression pattern matching (for example, using the regular expression "\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b") to validate the input. 
* email validation is complicated.  You can actually purchase or acquire an entire component / subsystem for email address validation, for example the Apache {{[Class EmailValidator|http://commons.apache.org/validator/api-1.3.1/org/apache/commons/validator/EmailValidator.html]}} 
* The command interpreter invoked is system dependent, so is difficult to say that this solution will not allow command injection in every environment in which a Java program might run.

h2. Compliant Solution (Parametrization)

A further improvement to the previous compliant solution is to parametrize the call to the {{exec()}} method. There are six forms of the {{exec()}} method, most of which are convenience methods for the following method:  

{code}
 public Process exec(String[] cmdarray,
    = proc.waitFor();
    if (result != 0) {
      System.out.println("process error: " + result);
    }
    InputStream in = (result == 0) ? proc.getInputStream() :
                                     proc.getErrorStream();
    int c;
    while ((c = in.read()) != -1) {
      System.out.print((char) c);
    }
  }
}

java -Ddir='dummy & echo bad' Java

cmd.exe /C dir dummy & echo bad

class DirList {
  public static void main(String[] args) throws Exception {
    String dir = System.getProperty("dir");
    Runtime rt = Runtime.getRuntime();
    Process proc = rt.exec(new String[] {"sh", "-c", "ls " + dir});
    int result = proc.waitFor();
    if (result != 0) {
      System.out.println("process error: " + result);
    }
    InputStream in = (result == 0) ? proc.getInputStream() :
                String[] envp,
                    File dir)proc.getErrorStream();
    int c;
    while ((c = in.read()) != throws-1) IOException
{code}

Using  any form of the {{exec()}} method where the first argument is an array containing the command to call and its arguments is generally safer because the command itself does not contain untrusted data.  

{code:bgColor=#ccccff}
String address = System.getProperty("email");
if (address == null) {
  // handle error
}
 System.out.print((char) c);
    }
  }
}

sh -c 'ls dummy & echo bad'

// ...
if (!Pattern.matches("[0-9A-Za-z@.]+", addressdir)) {
  // Handle error
}
// ...

// ...
String dir
String[] command = {"mail", address};
Runtime runtime = Runtime.getRuntime();
Process proc = runtime.exec(command, null, null); 
{code}

In some cases, this can still result in an argument injection attack.

h2. Compliant Solution (Not passing untrusted data to the {{exec()}} method)

This compliant solution prevents command injection by requiring the user to select one of a predefined group of addresses. This prevents untrusted data from being added to the command.

{code:bgColor=#ccccff}
String address = null;

int filenamenumber = Integer.parseInt(System.getpropertygetProperty("addressdir")); // onlyOnly allow integer choices
switch (filenamenumber) {
  case 1: 
    addressdir = "root@localhostdata1";
    break; // Option 1
  case 2: 
    addressdir = "postmaster@localhostdata2";
    break; // Option 2
  default: // invalidInvalid
    break; 
}
if (addressdir == null) {
  // handleHandle error
}

Runtime runtime = Runtime.getRuntime();
Process proc = runtime.exec("mail " + address); 
{code}


h2. Risk Assessment

OS command injection can cause arbitrary programs to be executed.

|| Guideline || Severity || Likelihood || Remediation Cost || Priority || Level ||
| IDS06-J | high | probable | medium | {color:red}{*}P12{*}{color} | {color:red}{*}L1{*}{color} |



h3. Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the [CERT website|https://www.kb.cert.org/vulnotes/bymetric?searchview&query=FIELD+KEYWORDS+contains+MSC32-J].



h2. Bibliography

\[[Chess 2007|AA. Bibliography#Chess 07]\] Chapter 5: Handling Input, "Command Injection"
\[[MITRE 2009|AA. Bibliography#MITRE 09]\] [CWE ID 78|http://cwe.mitre.org/data/definitions/78.html] "Failure to Preserve OS Command Structure (aka 'OS Command Injection')"
\[[OWASP 2005|AA. Bibliography#OWASP 05]\] [Reviewing Code for OS Injection|http://www.owasp.org/index.php/Reviewing_Code_for_OS_Injection]
\[[Permissions 2008|AA. Bibliography#Permissions 08]\] [Permissions in the Java™ SE 6 Development Kit (JDK)|http://java.sun.com/javase/6/docs/technotes/guides/security/permissions.html], Sun Microsystems, Inc. (2008)

----
[!The CERT Oracle Secure Coding Standard for Java^button_arrow_left.png!|IDS05-J. Library methods should validate their parameters]      [!The CERT Oracle Secure Coding Standard for Java^button_arrow_up.png!|13. Input Validation and Data Sanitization (IDS)]      [!The CERT Oracle Secure Coding Standard for Java^button_arrow_right.png!|IDS07-J. Prevent SQL Injection]

import java.io.File;

class DirList {
  public static void main(String[] args) throws Exception {
    File dir = new File(System.getProperty("dir"));
    if (!dir.isDirectory()) {
      System.out.println("Not a directory");
    } else {
      for (String file : dir.list()) {
        System.out.println(file);
      }
    }
  }
}