目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-95 动态执行代码中指令转义处理不恰当(Eval注入) 类漏洞列表 128

CWE-95 动态执行代码中指令转义处理不恰当(Eval注入) 类弱点 128 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-95 属于代码注入类漏洞，指程序在接收上游输入后，未正确净化代码语法便直接用于动态执行调用（如 eval）。攻击者通常通过构造恶意输入，诱导程序执行任意代码，从而获取系统控制权或窃取数据。开发者应避免使用动态执行函数，若必须使用，需严格对输入进行白名单校验或转义特殊字符，确保仅允许预期的安全代码片段被执行，从而从根源上阻断注入风险。

MITRE CWE 官方描述
CWE：CWE-95 动态评估代码中指令的不当中和（'Eval Injection'） 英文：产品从上游组件接收输入，但在将输入用于动态评估调用（例如 "eval"）之前，未对代码语法进行中和或中和不当。
常见影响 (5)
ConfidentialityRead Files or Directories, Read Application Data
The injected code could access restricted data / files.
Access ControlBypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
Access ControlGain Privileges or Assume Identity
Injected code can access resources that the attacker is directly prevented from accessing.
Integrity, Confidentiality, Availability, OtherExecute Unauthorized Code or Commands
Code injection attacks can lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing. Additionally, code injection can often result in the execution of arbitrary code or at least modify what code can be executed.
Non-RepudiationHide Activities
Often the actions performed by injected control code are unlogged.
缓解措施 (4)
Architecture and Design, ImplementationIf possible, refactor your code so that it does not need to use eval() at all.
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
ImplementationInputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180, CWE-181). Make sure that your application does not inadvertently decode the same input twice (CWE-174). Such errors could be used to bypass allowlist schemes by introducing dangerous inputs after they have been checked. Use libraries such as the OWASP ESAPI Canonicalizat…
ImplementationFor Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
Effectiveness: Discouraged Common Practice
代码示例 (2)
edit-config.pl: This CGI script is used to modify settings in a configuration file.
use CGI qw(:standard); sub config_file_add_key { my ($fname, $key, $arg) = @_; # code to add a field/key to a file goes here } sub config_file_set_key { my ($fname, $key, $arg) = @_; # code to set key to a particular file goes here } sub config_file_delete_key { my ($fname, $key, $arg) = @_; # code to delete key from a particular file goes here } sub handleConfigAction { my ($fname, $action) = @_; my $key = param('key'); my $val = param('val'); # this is super-efficient code, especially if you have to invoke # any one of dozens of different functions! my $code = "config_file_$action_key(\$fnam
Bad · Perl
add_key(",","); system("/bin/ls");
Attack
This simple python3 script asks a user to supply a comma-separated list of numbers as input and adds them together.
def main(): sum = 0 try: numbers = eval(input("Enter a comma-separated list of numbers: ")) except SyntaxError: print("Error: invalid input") return for num in numbers: sum = sum + num print(f"Sum of {numbers} = {sum}") main()
Bad · Python
__import__('subprocess').getoutput('rm -r *')
Attack
CVE ID标题CVSS风险等级Published
CVE-2022-38193 Esri Portal For ArcGis 代码注入漏洞 — Portal for ArcGIS 6.1 Medium2022-08-16
CVE-2022-36010 React Editable Json Tree 安全漏洞 — react-editable-json-tree 10.0 Critical2022-08-15
CVE-2021-33678 SAP NetWeaver AS ABAP 代码注入漏洞 — SAP NetWeaver AS ABAP (Reconciliation Framework) 6.5 -2021-07-14
CVE-2021-23277 Eaton Intelligent Power Manager 代码注入漏洞 — Intelligent Power manager (IPM) 8.3 High2021-04-13
CVE-2019-9507 Vertiv Avocent UMG-4000 命令注入漏洞 — Avocent UMG-4000 8.3 High2020-03-30
CVE-2020-6650 Eaton UPS companion software 代码注入漏洞 — UPS Companion Software 8.3 High2020-03-23
CVE-2020-5256 BookStack 代码问题漏洞 — BookStack 7.9 High2020-03-09
CVE-2020-5217 RubyGems 注入漏洞 — secure_headers 4.4 Medium2020-01-23

CWE-95（动态执行代码中指令转义处理不恰当(Eval注入)） 是常见的弱点类别，本平台收录该类弱点关联的 128 条 CVE 漏洞。