CWE-94 Detail

CWE-94

Improper Control of Generation of Code ('Code Injection')
Medio
Draft
2006-07-19
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Notifiche per un CWE specifico
Rimani informato su qualsiasi modifica relativa a un CWE specifico.
Gestione notifiche

Nome: Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

General Informations

Modes Of Introduction

Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Piattaforme applicabili

Linguaggio

Class: Interpreted (Sometimes)

Tecnologie

Name: AI/ML (Undetermined)

Conseguenze comuni

Ambito Impatto Probabilità
Access ControlBypass Protection Mechanism

Note: In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
Access ControlGain Privileges or Assume Identity

Note: Injected code can access resources that the attacker is directly prevented from accessing.
Integrity
Confidentiality
Availability		Execute Unauthorized Code or Commands

Note: When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. As a result, code injection can often result in the execution of arbitrary code. Code injection attacks can also lead to loss of data integrity in nearly all cases, since the control-plane data injected is always incidental to data recall or writing.
Non-RepudiationHide Activities

Note: Often the actions performed by injected control code are unlogged.

Esempi osservati

Riferimenti Descrizione

CVE-2023-29374

Math component in an LLM framework translates user input into a Python expression that is input into the Python exec() method, allowing code execution - one variant of a "prompt injection" attack.

CVE-2024-5565

Python-based library uses an LLM prompt containing user input to dynamically generate code that is then fed as input into the Python exec() method, allowing code execution - one variant of a "prompt injection" attack.

CVE-2024-4181

Framework for LLM applications allows eval injection via a crafted response from a hosting provider.

CVE-2022-2054

Python compiler uses eval() to execute malicious strings as Python code.

CVE-2021-22204

Chain: regex in EXIF processor code does not correctly determine where a string ends (CWE-625), enabling eval injection (CWE-95), as exploited in the wild per CISA KEV.

CVE-2020-8218

"Code injection" in VPN product, as exploited in the wild per CISA KEV.

CVE-2008-5071

Eval injection in PHP program.

CVE-2002-1750

Eval injection in Perl program.

CVE-2008-5305

Eval injection in Perl program using an ID that should only contain hyphens and numbers.

CVE-2002-1752

Direct code injection into Perl eval function.

CVE-2002-1753

Eval injection in Perl program.

CVE-2005-1527

Direct code injection into Perl eval function.

CVE-2005-2837

Direct code injection into Perl eval function.

CVE-2005-1921

MFV. code injection into PHP eval statement using nested constructs that should not be nested.

CVE-2005-2498

MFV. code injection into PHP eval statement using nested constructs that should not be nested.

CVE-2005-3302

Code injection into Python eval statement from a field in a formatted file.

CVE-2007-1253

Eval injection in Python program.

CVE-2001-1471

chain: Resultant eval injection. An invalid value prevents initialization of variables, which can be modified by attacker and later injected into PHP eval statement.

CVE-2002-0495

Perl code directly injected into CGI library file from parameters to another CGI program.

CVE-2005-1876

Direct PHP code injection into supporting template file.

CVE-2005-1894

Direct code injection into PHP script that can be accessed by attacker.

CVE-2003-0395

PHP code from User-Agent HTTP header directly inserted into log file implemented as PHP script.

Potential Mitigations

Phases : Architecture and Design
Refactor your program so that you do not have to dynamically generate code.
Phases : Architecture and Design
Phases : Implementation
Phases : Testing
Use automated static analysis tools that target this type of weakness. Many modern techniques use data flow analysis to minimize the number of false positives. This is not a perfect solution, since 100% accuracy and coverage are not feasible.
Phases : Testing
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Phases : Operation
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Phases : Operation
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Phases : Implementation

Detection Methods

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness : High

Note sulla mappatura delle vulnerabilità

Giustificazione : This entry is frequently misused for vulnerabilities with a technical impact of "code execution," which does not by itself indicate a root cause weakness, since dozens of weaknesses can enable code execution.
Commento : This weakness only applies when the product's functionality intentionally constructs all or part of a code segment. It could be that executing code could be the result of other weaknesses that do not involve the construction of code segments.

Pattern di attacco correlati

CAPEC-ID Nome del pattern di attacco
CAPEC-242 Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35 Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77 Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

Note


Riferimenti

REF-44

24 Deadly Sins of Software Security
Michael Howard, David LeBlanc, John Viega.

REF-1372

How ast.literal_eval can cause memory exhaustion
https://www.reddit.com/r/learnpython/comments/zmbhcf/how_astliteral_eval_can_cause_memory_exhaustion/

REF-1373

ast - Abstract Syntax Trees
https://docs.python.org/3/library/ast.html#ast.literal_eval

Invio

Nome Organizzazione Data Data di rilascio Version
PLOVER 2006-07-19 +00:00 2006-07-19 +00:00 Draft 3

Modifiche

Nome Organizzazione Data Commento
Eric Dalci Cigital 2008-07-01 +00:00 updated Time_of_Introduction
CWE Content Team MITRE 2008-09-08 +00:00 updated Applicable_Platforms, Relationships, Research_Gaps, Taxonomy_Mappings
CWE Content Team MITRE 2009-01-12 +00:00 updated Common_Consequences, Demonstrative_Examples, Description, Likelihood_of_Exploit, Name, Potential_Mitigations, Relationships
CWE Content Team MITRE 2009-03-10 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2009-05-27 +00:00 updated Demonstrative_Examples, Name
CWE Content Team MITRE 2010-02-16 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2010-06-21 +00:00 updated Description, Potential_Mitigations
CWE Content Team MITRE 2011-03-29 +00:00 updated Name
CWE Content Team MITRE 2011-06-01 +00:00 updated Common_Consequences
CWE Content Team MITRE 2012-05-11 +00:00 updated Common_Consequences, Demonstrative_Examples, Observed_Examples, References, Relationships
CWE Content Team MITRE 2012-10-30 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2013-02-21 +00:00 updated Relationships
CWE Content Team MITRE 2014-07-30 +00:00 updated Relationships
CWE Content Team MITRE 2015-12-07 +00:00 updated Relationships
CWE Content Team MITRE 2017-11-08 +00:00 updated Demonstrative_Examples, Modes_of_Introduction, Relationships
CWE Content Team MITRE 2019-06-20 +00:00 updated Related_Attack_Patterns, Type
CWE Content Team MITRE 2019-09-19 +00:00 updated Relationships
CWE Content Team MITRE 2020-02-24 +00:00 updated Potential_Mitigations, Relationships
CWE Content Team MITRE 2020-06-25 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2020-08-20 +00:00 updated Relationships
CWE Content Team MITRE 2021-03-15 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2021-07-20 +00:00 updated Relationships
CWE Content Team MITRE 2021-10-28 +00:00 updated Relationships
CWE Content Team MITRE 2022-04-28 +00:00 updated Research_Gaps
CWE Content Team MITRE 2022-06-28 +00:00 updated Observed_Examples, Relationships
CWE Content Team MITRE 2022-10-13 +00:00 updated Observed_Examples
CWE Content Team MITRE 2023-01-31 +00:00 updated Demonstrative_Examples, Description, Potential_Mitigations, Relationships
CWE Content Team MITRE 2023-04-27 +00:00 updated Demonstrative_Examples, Detection_Factors, Relationships, Time_of_Introduction
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes, Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2024-02-29 +00:00 updated Demonstrative_Examples, Potential_Mitigations, References
CWE Content Team MITRE 2024-07-16 +00:00 updated Applicable_Platforms, Observed_Examples
CWE Content Team MITRE 2024-11-19 +00:00 updated Mapping_Notes, Relationships
CWE Content Team MITRE 2025-04-03 +00:00 updated Alternate_Terms, Common_Consequences, Description, Diagram, Theoretical_Notes
CWE Content Team MITRE 2025-12-11 +00:00 updated Demonstrative_Examples, Relationships, Weakness_Ordinalities
Le informazioni presentate su CVE Find provengono da diverse fonti di riferimento attentamente selezionate. I dati CVE sono forniti da MITRE Corporation e dal National Vulnerability Database (NVD). Il catalogo delle vulnerabilità sfruttate conosciute (KEV) proviene dalla Cybersecurity and Infrastructure Security Agency (CISA), mentre i punteggi EPSS provengono da FIRST.org. Inoltre, i dati relativi alle vulnerabilità software (CWE) e ai pattern di attacco comuni (CAPEC) sono mantenuti da MITRE Corporation, e le informazioni sulle configurazioni hardware e software (CPE) sono fornite da NVD.