CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
8276 vulnerabilities reference this CWE, most recent first.
GHSA-WX6P-35HF-VHHJ
Vulnerability from github – Published: 2022-05-02 03:29 – Updated: 2025-10-22 03:30Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.
{
"affected": [],
"aliases": [
"CVE-2009-1862"
],
"database_specific": {
"cwe_ids": [
"CWE-787",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-07-23T20:30:00Z",
"severity": "HIGH"
},
"details": "Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.",
"id": "GHSA-wx6p-35hf-vhhj",
"modified": "2025-10-22T03:30:27Z",
"published": "2022-05-02T03:29:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1862"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1862"
},
{
"type": "WEB",
"url": "http://blogs.adobe.com/psirt/2009/07/potential_adobe_reader_and_fla.html"
},
{
"type": "WEB",
"url": "http://bugs.adobe.com/jira/browse/FP-1265"
},
{
"type": "WEB",
"url": "http://isc.sans.org/diary.html?storyid=6847"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html"
},
{
"type": "WEB",
"url": "http://news.cnet.com/8301-27080_3-10293389-245.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36193"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36374"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36701"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200908-04.xml"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT3864"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT3865"
},
{
"type": "WEB",
"url": "http://www.adobe.com/support/security/advisories/apsa09-03.html"
},
{
"type": "WEB",
"url": "http://www.adobe.com/support/security/bulletins/apsb09-10.html"
},
{
"type": "WEB",
"url": "http://www.adobe.com/support/security/bulletins/apsb09-13.html"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/259425"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/35759"
},
{
"type": "WEB",
"url": "http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-072209-2512-99"
},
{
"type": "WEB",
"url": "http://www.symantec.com/connect/blogs/next-generation-flash-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WX6V-QWX9-2PVV
Vulnerability from github – Published: 2022-05-01 07:31 – Updated: 2022-05-01 07:31PHP remote file inclusion vulnerability in includes/xhtml.php in Drake CMS 0.2.2 alpha rev.846 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the d_root parameter.
{
"affected": [],
"aliases": [
"CVE-2006-5767"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2006-11-06T23:07:00Z",
"severity": "MODERATE"
},
"details": "PHP remote file inclusion vulnerability in includes/xhtml.php in Drake CMS 0.2.2 alpha rev.846 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the d_root parameter.",
"id": "GHSA-wx6v-qwx9-2pvv",
"modified": "2022-05-01T07:31:26Z",
"published": "2022-05-01T07:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2006-5767"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30021"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/2713"
},
{
"type": "WEB",
"url": "http://sourceforge.net/forum/forum.php?forum_id=636860"
},
{
"type": "WEB",
"url": "http://www.attrition.org/pipermail/vim/2006-December/001202.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/20914"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2006/4345"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WX72-XP52-V927
Vulnerability from github – Published: 2025-01-28 21:31 – Updated: 2025-01-28 21:31A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default permissions and allows for DLLs to be executed with higher level permissions.
{
"affected": [],
"aliases": [
"CVE-2025-24482"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-28T21:15:18Z",
"severity": "HIGH"
},
"details": "A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default permissions and allows for DLLs to be executed with higher level permissions.",
"id": "GHSA-wx72-xp52-v927",
"modified": "2025-01-28T21:31:04Z",
"published": "2025-01-28T21:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24482"
},
{
"type": "WEB",
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1720.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-WX8F-9362-6RFQ
Vulnerability from github – Published: 2022-05-01 23:55 – Updated: 2022-05-01 23:55The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.
{
"affected": [],
"aliases": [
"CVE-2008-2950"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-07-07T23:41:00Z",
"severity": "HIGH"
},
"details": "The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.",
"id": "GHSA-wx8f-9362-6rfq",
"modified": "2022-05-01T23:55:07Z",
"published": "2022-05-01T23:55:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-2950"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43619"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/6032"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00161.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/30963"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31002"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31167"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31267"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31405"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200807-04.xml"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/3977"
},
{
"type": "WEB",
"url": "http://wiki.rpath.com/Advisories:rPSA-2008-0223"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:146"
},
{
"type": "WEB",
"url": "http://www.ocert.org/advisories/ocert-2008-007.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/493980/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/494142/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/30107"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1020435"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/usn-631-1"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/2024/references"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WX8V-RVWG-8393
Vulnerability from github – Published: 2024-08-12 21:31 – Updated: 2024-08-13 18:31In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenicated Attackers can send malicious packet to execute arbitary commands.
{
"affected": [],
"aliases": [
"CVE-2024-42745"
],
"database_specific": {
"cwe_ids": [
"CWE-78",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-12T20:15:09Z",
"severity": "HIGH"
},
"details": "In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenicated Attackers can send malicious packet to execute arbitary commands.",
"id": "GHSA-wx8v-rvwg-8393",
"modified": "2024-08-13T18:31:14Z",
"published": "2024-08-12T21:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42745"
},
{
"type": "WEB",
"url": "https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setUPnPCfg/setUPnPCfg.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WXCG-G67V-XRP9
Vulnerability from github – Published: 2022-05-24 17:23 – Updated: 2022-05-24 17:23HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and earlier) has a php code injection vulnerability.
{
"affected": [],
"aliases": [
"CVE-2020-7206"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-07-17T22:15:00Z",
"severity": "HIGH"
},
"details": "HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and earlier) has a php code injection vulnerability.",
"id": "GHSA-wxcg-g67v-xrp9",
"modified": "2022-05-24T17:23:56Z",
"published": "2022-05-24T17:23:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7206"
},
{
"type": "WEB",
"url": "https://github.com/HewlettPackard/nagios-plugins-hpilo/commit/7617b2736a95c7f354198f092febe37e7005c677"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WXGP-JGC5-77QV
Vulnerability from github – Published: 2022-05-02 03:51 – Updated: 2022-05-02 03:51PHP remote file inclusion vulnerability in class/php/d4m_ajax_pagenav.php in the D4J eZine (com_ezine) component 2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path parameter.
{
"affected": [],
"aliases": [
"CVE-2009-4094"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-11-29T13:07:00Z",
"severity": "HIGH"
},
"details": "PHP remote file inclusion vulnerability in class/php/d4m_ajax_pagenav.php in the D4J eZine (com_ezine) component 2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path parameter.",
"id": "GHSA-wxgp-jgc5-77qv",
"modified": "2022-05-02T03:51:33Z",
"published": "2022-05-02T03:51:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4094"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54307"
},
{
"type": "WEB",
"url": "http://www.kamtiez.org/2009/11/joomla-mambo-component-comezine-remote.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/37043"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WXH8-G87C-56GX
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-07-13 00:00IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the authenticated victim would execute the code. IBM X-Force ID: 182395.
{
"affected": [],
"aliases": [
"CVE-2020-4520"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-01T14:15:00Z",
"severity": "HIGH"
},
"details": "IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the authenticated victim would execute the code. IBM X-Force ID: 182395.",
"id": "GHSA-wxh8-g87c-56gx",
"modified": "2022-07-13T00:00:51Z",
"published": "2022-05-24T19:03:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4520"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182395"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210622-0004"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6451705"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WXHW-J4HC-FMQ6
Vulnerability from github – Published: 2026-01-27 19:55 – Updated: 2026-01-29 03:43Summary
A sandbox escape vulnerability due to AsyncFunction not being isolated in SandboxFunction
Details
The library attempts to sandbox code execution by replacing the global Function constructor with a safe, sandboxed version (SandboxFunction). This is handled in utils.ts by mapping Function to sandboxFunction within a map used for lookups.
However, the library did not include mappings for AsyncFunction, GeneratorFunction, and AsyncGeneratorFunction. These constructors are not global properties but can be accessed via the .constructor property of an instance (e.g., (async () => {}).constructor).
In executor.ts, property access is handled. When code running inside the sandbox accesses .constructor on an async function (which the sandbox allows creating), the executor retrieves the property value. Since AsyncFunction was not in the safe-replacement map, the executor returns the actual native host AsyncFunction constructor.
Constructors for functions in JavaScript (like Function, AsyncFunction) create functions that execute in the global scope. By obtaining the host AsyncFunction constructor, an attacker can create a new async function that executes entirely outside the sandbox context, bypassing all restrictions and gaining full access to the host environment (Remote Code Execution).
PoC
const sandbox = require('@nyariv/sandboxjs');
const s = new sandbox.default();
const payload = `
const af = async () => {};
// .constructor returns the host AsyncFunction constructor because it's not intercepted
const AsyncConstructor = af.constructor;
console.log("AsyncConstructor name:", AsyncConstructor.name);
// Create a function that executes outside the sandbox
const func = AsyncConstructor("return process.mainModule.require('child_process').execSync('id').toString()");
// Execute RCE
const p = func();
p.then(proc => {
console.log(proc);
});
`;
try {
s.compile(payload)().run();
} catch (e) {
console.error("Bypass failed:", e.message);
}
Run above script in nodejs. If you run it in browser, change the AsyncConstructor argument by returning window object.
Impact
A Remote Code Execution, attacker may be able to run an arbitrary code.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@nyariv/sandboxjs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.26"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-23830"
],
"database_specific": {
"cwe_ids": [
"CWE-693",
"CWE-913",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-27T19:55:11Z",
"nvd_published_at": "2026-01-28T00:15:50Z",
"severity": "CRITICAL"
},
"details": "### Summary\nA sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`\n\n### Details\n\nThe library attempts to sandbox code execution by replacing the global `Function` constructor with a safe, sandboxed version (`SandboxFunction`). This is handled in `utils.ts` by mapping `Function` to `sandboxFunction` within a map used for lookups.\n\nHowever, the library did not include mappings for `AsyncFunction`, `GeneratorFunction`, and `AsyncGeneratorFunction`. These constructors are not global properties but can be accessed via the `.constructor` property of an instance (e.g., `(async () =\u003e {}).constructor`).\n\nIn `executor.ts`, property access is handled. When code running inside the sandbox accesses `.constructor` on an async function (which the sandbox allows creating), the `executor` retrieves the property value. Since `AsyncFunction` was not in the safe-replacement map, the `executor` returns the actual native host `AsyncFunction` constructor.\n\nConstructors for functions in JavaScript (like `Function`, `AsyncFunction`) create functions that execute in the global scope. By obtaining the host `AsyncFunction` constructor, an attacker can create a new async function that executes entirely outside the sandbox context, bypassing all restrictions and gaining full access to the host environment (Remote Code Execution).\n\n### PoC\n\n```js\nconst sandbox = require(\u0027@nyariv/sandboxjs\u0027);\nconst s = new sandbox.default();\n\nconst payload = `\n const af = async () =\u003e {};\n // .constructor returns the host AsyncFunction constructor because it\u0027s not intercepted\n const AsyncConstructor = af.constructor;\n console.log(\"AsyncConstructor name:\", AsyncConstructor.name);\n \n // Create a function that executes outside the sandbox\n const func = AsyncConstructor(\"return process.mainModule.require(\u0027child_process\u0027).execSync(\u0027id\u0027).toString()\");\n \n // Execute RCE\n const p = func();\n p.then(proc =\u003e {\n console.log(proc);\n });\n`;\n\ntry {\n s.compile(payload)().run();\n} catch (e) {\n console.error(\"Bypass failed:\", e.message);\n}\n```\n\nRun above script in nodejs. If you run it in browser, change the `AsyncConstructor` argument by returning `window` object. \n\n### Impact\n\nA Remote Code Execution, attacker may be able to run an arbitrary code.",
"id": "GHSA-wxhw-j4hc-fmq6",
"modified": "2026-01-29T03:43:42Z",
"published": "2026-01-27T19:55:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nyariv/SandboxJS/security/advisories/GHSA-wxhw-j4hc-fmq6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23830"
},
{
"type": "WEB",
"url": "https://github.com/nyariv/SandboxJS/commit/345aee6566e47979dee5c337b925b141e7f78ccd"
},
{
"type": "PACKAGE",
"url": "https://github.com/nyariv/SandboxJS"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor"
}
GHSA-WXQG-FG7V-MMC6
Vulnerability from github – Published: 2022-05-13 01:05 – Updated: 2023-08-17 22:32Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.5.2"
},
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2013-3630"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-17T22:32:04Z",
"nvd_published_at": "2013-11-01T02:55:00Z",
"severity": "MODERATE"
},
"details": "Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.",
"id": "GHSA-wxqg-fg7v-mmc6",
"modified": "2023-08-17T22:32:04Z",
"published": "2022-05-13T01:05:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3630"
},
{
"type": "WEB",
"url": "https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-foss-disclosures-part-one"
},
{
"type": "WEB",
"url": "https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/164479/Moodle-Authenticated-Spelling-Binary-Remote-Code-Execution.html"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Moodle Authenticated Spelling Binary Remote Code Execution"
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.