Example - 1

This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.

$userName = $_POST["user"];$command = 'ls -l /home/' . $userName;system($command);

The $userName variable is not checked for malicious input. An attacker could set the $userName variable to an arbitrary OS command such as:

;rm -rf /

Which would result in $command being:

ls -l /home/;rm -rf /

Since the semi-colon is a command separator in Unix, the OS would first execute the ls command, then the rm command, deleting the entire file system.

Also note that this example code is vulnerable to Path Traversal (CWE-22) and Untrusted Search Path (CWE-426) attacks.

Example - 2

Consider the following program. It intends to perform an "ls -l" on an input filename. The validate_name() subroutine performs validation on the input to make sure that only alphanumeric and "-" characters are allowed, which avoids path traversal (CWE-22) and OS command injection (CWE-78) weaknesses. Only filenames like "abc" or "d-e-f" are intended to be allowed.

print "Error: name is not well-formed!\n";return;
// # build command// 
my($fname) = @_;if (! validate_name($fname)) {}my $cmd = "/bin/ls -l $fname";system($cmd);


return(1);

return(0);
my($name) = @_;if ($name =~ /^[\w\-]+$/) {}else {}my $arg = GetArgument("filename");do_listing($arg);sub do_listing {}sub validate_name {}

However, validate_name() alowsfilenames that begin with a "-". An adversary couldsupply a filename like "-aR", producing the "ls -l -aR"command (CWE-88), thereby getting a full recursivelisting of the entire directory and all of itssub-directories.There are a couple possible mitigations for thisweakness. One would be to refactor the code to avoidusing system() altogether, instead relying on internalfunctions.Another option could be to add a "--" argumentto the ls command, such as "ls -l --", so that anyremaining arguments are treated as filenames, causingany leading "-" to be treated as part of a filenameinstead of another option.Another fix might be to change the regular expression used in validate_name to force the first character of the filename to be a letter or number, such as:

if ($name =~ /^\w[\w\-]+$/) ...