Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CWE-94 (对生成代码的控制不恰当(代码注入)) — Vulnerability Class 1330

1330 vulnerabilities classified as CWE-94 (对生成代码的控制不恰当(代码注入)). AI Chinese analysis included.

CWE-94 represents a critical code injection weakness where software constructs executable code using untrusted input without proper sanitization. Attackers typically exploit this vulnerability by injecting malicious scripts or commands into user-supplied fields, such as web forms or API parameters, which the application then executes directly. This allows adversaries to bypass security controls, steal sensitive data, or gain unauthorized administrative access to the underlying system. To prevent such exploits, developers must rigorously validate and sanitize all external inputs, ensuring that only expected characters are processed. Implementing strict allow-listing strategies, utilizing parameterized queries for database interactions, and avoiding dynamic code execution functions like eval() are essential defensive measures. By treating all user input as potentially hostile and applying robust encoding techniques, organizations can effectively neutralize injection vectors and maintain application integrity.

MITRE CWE Description
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Common Consequences (4)
Access ControlBypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
Access ControlGain Privileges or Assume Identity
Injected code can access resources that the attacker is directly prevented from accessing.
Integrity, Confidentiality, AvailabilityExecute Unauthorized Code or Commands
When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. As a result, code injection can often result in the execution of arbitrary code. Code injection attacks can…
Non-RepudiationHide Activities
Often the actions performed by injected control code are unlogged.
Mitigations (5)
Architecture and DesignRefactor your program so that you do not have to dynamically generate code.
Architecture and DesignRun your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating s…
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
TestingUse dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
OperationRun the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Examples (2)
This example attempts to write user messages to a message file and allow users to view them.
$MessageFile = "messages.out"; if ($_GET["action"] == "NewMessage") { $name = $_GET["name"]; $message = $_GET["message"]; $handle = fopen($MessageFile, "a+"); fwrite($handle, "<b>$name</b> says '$message'<hr>\n"); fclose($handle); echo "Message Saved!<p>\n"; } else if ($_GET["action"] == "ViewMessages") { include($MessageFile); }
Bad · PHP
name=h4x0r message=%3C?php%20system(%22/bin/ls%20-l%22);?%3E
Attack
edit-config.pl: This CGI script is used to modify settings in a configuration file.
use CGI qw(:standard); sub config_file_add_key { my ($fname, $key, $arg) = @_; # code to add a field/key to a file goes here } sub config_file_set_key { my ($fname, $key, $arg) = @_; # code to set key to a particular file goes here } sub config_file_delete_key { my ($fname, $key, $arg) = @_; # code to delete key from a particular file goes here } sub handleConfigAction { my ($fname, $action) = @_; my $key = param('key'); my $val = param('val'); # this is super-efficient code, especially if you have to invoke # any one of dozens of different functions! my $code = "config_file_$action_key(\$fnam
Bad · Perl
add_key(",","); system("/bin/ls");
Attack
CVE IDTitleCVSSSeverityPublished
CVE-2017-16020 Summit 安全漏洞 — summit node module 9.8 -2018-06-04
CVE-2017-16042 Growl 安全漏洞 — growl node module 9.8 -2018-06-04
CVE-2014-10065 remarkable 跨站脚本漏洞 — remarkable node module 6.1 -2018-05-31
CVE-2016-10546 PouchDB 安全漏洞 — pouchdb node module 9.8 -2018-05-31
CVE-2016-10548 reduce-css-calc node模块安全漏洞 — reduce-css-calc node module 6.1 -2018-05-31
CVE-2018-1273 Pivotal Software Spring Data Commons和Spring Data REST 输入验证错误漏洞 — Spring Framework 9.8 -2018-04-11
CVE-2018-1275 Pivotal Spring Framework 安全漏洞 — Spring Framework 9.8 -2018-04-11
CVE-2018-1270 Pivotal Software Spring Framework 代码注入漏洞 — Spring Framework 9.8 -2018-04-06
CVE-2017-1001002 Math.js JavaScript引擎安全漏洞 — math.js 9.8 -2017-11-27
CVE-2017-1001004 typed-function JavaScript引擎安全漏洞 — typed-function 8.8 -2017-11-27

Vulnerabilities classified as CWE-94 (对生成代码的控制不恰当(代码注入)) represent 1330 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.