IDS06-J. Prevent OS Command Injection

OS command injection vulnerabilities occur when an application fails to sanitize untrusted input and uses it in the execution of arbitrary system commands (with carefully chosen arguments) or of an external program. This is a specific instance of the guideline IDS01-J. Sanitize data passed across a trust boundary.

OS Command Injection Example

Suppose a Java program wants to send email using the mail program. It might ask the user for an email address. The command might take the form:

mail <ADDRESS>

However, if an attacker supplies the following value for <ADDRESS>:

noboday@nowhere.com ; useradd attacker

the command executed is actually two commands:

mail noboday@nowhere.com ;
useradd attacker

which causes a new account to be created for the attacker.

Noncompliant Code Example

A weakness in a privileged program caused by relying on untrusted sources such as the environment (see guideline ENV06-J. Provide a trusted environment and sanitize all inputs) can result in the execution of a command or of a program that has privileges beyond those possessed by a typical user.

This noncompliant code example attempts to send a message to an email address supplied by an untrusted user. Since no sanitization is done on the address, the attack outlined above would work as described.

  
String address = System.getProperty("email");
if (address == null) {
  // handle error
}

Runtime runtime = Runtime.getRuntime();
Process proc = runtime.exec("mail " + address); 
}

Compliant Solution (Whitelisting)

This compliant solution sanitizes the email address by permitting only a handful of correct characters to appear, thus preventing command injection.

  
String address = System.getProperty("email");
if (address == null) {
  // handle error
}
if (!Pattern.matches("[0-9A-Za-z@.]+", address)) {
  // Handle error
}

Runtime runtime = Runtime.getRuntime();
Process proc = runtime.exec("mail " + address); 
}

Compliant Solution

This compliant solution prevents command injection by requiring the user to select one of a predefined group of addresses. This prevents untrusted data from being added to the command.

String address = null;

int filename = Integer.parseInt(System.getproperty("address")); // only allow integer choices
switch(filename) {
  case 1: 
    address = "root@localhost"
    break; // Option 1
  case 2: 
    address = "postmaster@localhost"
    break; // Option 2
  default: // invalid
    break; 
}
if (address == null) {
  // handle error
}

Runtime runtime = Runtime.getRuntime();
Process proc = runtime.exec("mail " + address); 

Risk Assessment

OS command injection can cause arbitrary programs to be executed.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

[[Chess 2007]] Chapter 5: Handling Input, "Command Injection"
[[MITRE 2009]] CWE ID 78 "Failure to Preserve OS Command Structure (aka 'OS Command Injection')"
[[OWASP 2005]] Reviewing Code for OS Injection
[[Permissions 2008]] Permissions in the Java™ SE 6 Development Kit (JDK), Sun Microsystems, Inc. (2008)

IDS05-J. Library methods should validate their parameters      13. Input Validation and Data Sanitization (IDS)      IDS07-J. Prevent SQL Injection