Unsanitized User Input in OS Command

Overview

• Rule ID: java_lang_os_command_injection

• Applicable Languages: Java

• Weakness ID: CWE-78

Description

Directly including external or user-defined input in an OS command exposes the system to potential command injection attacks. This vulnerability allows attackers to execute unauthorized commands on the operating system, potentially compromising system integrity.

Remediation Guidelines

• Avoid using OS commands that incorporate dynamic input directly. Instead, consider safer alternatives such as libraries or built-in functions that achieve the same objective without executing system commands.

• Use hardcoded values for any input included in OS commands. This approach minimizes risk by ensuring only predefined inputs are used, preventing attackers from injecting malicious commands.

  String filePattern = "*.json";
  if ("xml".equals(request.getParameter("format"))) {
  filePattern = "*.xml";
  }
  
  Process process = Runtime.getRuntime().exec("ls /myDir/" + filePattern);

References

• OWASP command injection explained

• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

• OWASP Top 10: A03:2021 - Injection

Configuration

To omit this rule during a scan, and to provide you with continuous 24/7 code-level scanning, you can employ our SAST TOOL