IDS06-J. Do not pass untrusted, unsanitized data to the Runtime.exec() method

External programs are commonly invoked to perform a function required by the overall system. This is a form of reuse and might even be considered a crude form of component-based software engineering. Command and argument injection vulnerabilities occur when an application fails to sanitize untrusted input and uses it in the execution of external programs.

Every Java application has a single instance of class Runtime that allows the application to interface with the environment in which the application is running. The current runtime can be obtained from the getRuntime() method. The semantics of Runtime.exec are poorly defined, so it's best not to rely on its behavior any more than necessary. It will invoke the command directly without a shell. If you want a shell, you can use "/bin/sh", "-c" on UNIX or "cmd.exe" on Windows. The variants of exec)( that take the command line a single String split it with a StringTokenizer. On Windows, these tokens will be concatenated back into a single argument string somewhere along the line.

Consequently, command injection doesn't work unless a command interpreter is explicitly invoked. However, particularly on Windows, there can be vulnerabilities where arguments have spaces, double quotes, etc., in or start with a - or / to indicate a switch.

This is a specific instance of the guideline IDS01-J. Sanitize data passed across a trust boundary. Any string data that originates from outside the program's trust boundary must be sanitized before being executed as a command on the current platform.

Noncompliant Code Example (Windows)

A weakness in a privileged program caused by relying on untrusted sources such as system properties or the environment (see guideline ENV06-J. Provide a trusted environment and sanitize all inputs) can result in the execution of a command or of a program that has privileges beyond those possessed by a typical user.

This noncompliant code example provides a listing of the directory that is provided by the dir system property. It accomplishes this by using Runtime.exec() to invoke the Windows dir command.

  
import java.io.InputStream;

class DirList {

  public static void main(String[] args) throws Exception {
    String dir = System.getProperty("dir");
    Runtime rt = Runtime.getRuntime();
    Process proc = rt.exec("cmd.exe /C dir " + dir);
    int result = proc.waitFor();
    if (result != 0) {
      System.out.println("process error: " + result);
    }
    InputStream in = (result == 0) ? proc.getInputStream() : proc.getErrorStream();
    int c;
    while ((c = in.read()) != -1) {
      System.out.print((char) c);
    }
  }
}

Since Runtime.exec() receives unsanitized data originating from the environment (see guideline ENV06-J. Provide a trusted environment and sanitize all inputs), this code is susceptible to a command injection attack.

An attacker can exploit this program using the following command:

java -Ddir='dummy & echo bad' Java

the command executed is actually two commands:

cmd.exe /C dir dummy & echo bad

which first attempts to list a nonexistent dummy folder, and then prints bad to the console.

Noncompliant Code Example (POSIX)

This noncompliant code example provides the same functionality, but uses the POSIX ls command. The only difference from the Windows version is the argument passed to proc.

  
import java.io.InputStream;

class DirList {

  public static void main(String[] args) throws Exception {
    String dir = System.getProperty("dir");
    Runtime rt = Runtime.getRuntime();
    Process proc = rt.exec(new String[] {"sh", "-c", "ls " + dir});
    int result = proc.waitFor();
    if (result != 0) {
      System.out.println("process error: " + result);
    }
    InputStream in = (result == 0) ? proc.getInputStream() : proc.getErrorStream();
    int c;
    while ((c = in.read()) != -1) {
      System.out.print((char) c);
    }
  }
}

The attacker can supply the same command, with the same effects as above. The command executed is actually:

sh -c 'ls dummy & echo bad'

Compliant Solution (Sanitization)

This compliant solution sanitizes the email address by permitting only a handful of correct characters to appear.

String address = System.getProperty("email");
if (address == null) {
  // handle error
}
if (!Pattern.matches("[0-9A-Za-z@.]+", address)) {
  // Handle error
}

Runtime runtime = Runtime.getRuntime();
Process proc = runtime.exec("mail " + address); 

Although this is a compliant solution, the sanitization method is weak because:

• it will reject valid email addresses
• it doesn't require any syntax or regular expression pattern matching (for example, using the regular expression

  "\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b")

  to validate the input.
• email validation is complicated. You can actually purchase or acquire an entire component / subsystem for email address validation, for example the Apache Class EmailValidator
• The command interpreter invoked is system dependent, so is difficult to say that this solution will not allow command injection in every environment in which a Java program might run.

Compliant Solution (Parametrization)

A further improvement to the previous compliant solution is to parametrize the call to the exec() method. There are six forms of the exec() method, most of which are convenience methods for the following method:

 public Process exec(String[] cmdarray,
                    String[] envp,
                    File dir)
             throws IOException

Using any form of the exec() method where the first argument is an array containing the command to call and its arguments is generally safer because the command itself does not contain untrusted data.

String address = System.getProperty("email");
if (address == null) {
  // handle error
}
if (!Pattern.matches("[0-9A-Za-z@.]+", address)) {
  // Handle error
}

String[] command = {"mail", address};
Runtime runtime = Runtime.getRuntime();
Process proc = runtime.exec(command, null, null); 

In some cases, this can still result in an argument injection attack.

Compliant Solution (Not passing untrusted data to the exec() method)

This compliant solution prevents command injection by requiring the user to select one of a predefined group of addresses. This prevents untrusted data from being added to the command.

String address = null;

int filename = Integer.parseInt(System.getproperty("address")); // only allow integer choices
switch(filename) {
  case 1: 
    address = "root@localhost"
    break; // Option 1
  case 2: 
    address = "postmaster@localhost"
    break; // Option 2
  default: // invalid
    break; 
}
if (address == null) {
  // handle error
}

Runtime runtime = Runtime.getRuntime();
Process proc = runtime.exec("mail " + address); 

This compliant solution hard codes the email addresses which becomes unmanageable if you have many email addresses. A more extensible solution is to read all the email addresses from a properties file into a java.util.Properties object.

Risk Assessment

OS command injection can cause arbitrary programs to be executed.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

[[Chess 2007]] Chapter 5: Handling Input, "Command Injection"
[[MITRE 2009]] CWE ID 78 "Failure to Preserve OS Command Structure (aka 'OS Command Injection')"
[[OWASP 2005]] Reviewing Code for OS Injection
[[Permissions 2008]] Permissions in the Java™ SE 6 Development Kit (JDK), Sun Microsystems, Inc. (2008)

      13. Input Validation and Data Sanitization (IDS)      IDS07-J. Prevent SQL Injection