CWE-95 Detail

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Gemiddeld
Incomplete
2006-07-19
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Meldingen voor een CWE
Blijf op de hoogte van wijzigingen voor een specifieke CWE.
Meldingen beheren

Naam: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Algemene informatie

Introductiemodi

Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Implementation : This weakness is prevalent in handler/dispatch procedures that might want to invoke a large number of functions, or set a large number of variables.

Toepasselijke platforms

Taal

Name: Java (Undetermined)
Name: JavaScript (Undetermined)
Name: Python (Undetermined)
Name: Perl (Undetermined)
Name: PHP (Undetermined)
Name: Ruby (Undetermined)
Class: Interpreted (Undetermined)

Technologieën

Name: AI/ML (Undetermined)

Veelvoorkomende gevolgen

Bereik Impact Waarschijnlijkheid
ConfidentialityRead Files or Directories, Read Application Data

Note: The injected code could access restricted data / files.
Access ControlBypass Protection Mechanism

Note: In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
Access ControlGain Privileges or Assume Identity

Note: Injected code can access resources that the attacker is directly prevented from accessing.
Integrity
Confidentiality
Availability
Other		Execute Unauthorized Code or Commands

Note: Code injection attacks can lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing. Additionally, code injection can often result in the execution of arbitrary code or at least modify what code can be executed.
Non-RepudiationHide Activities

Note: Often the actions performed by injected control code are unlogged.

Waargenomen voorbeelden

Referenties Beschrijving

CVE-2024-4181

Framework for LLM applications allows eval injection via a crafted response from a hosting provider.

CVE-2022-2054

Python compiler uses eval() to execute malicious strings as Python code.

CVE-2021-22204

Chain: regex in EXIF processor code does not correctly determine where a string ends (CWE-625), enabling eval injection (CWE-95), as exploited in the wild per CISA KEV.

CVE-2021-22205

Chain: backslash followed by a newline can bypass a validation step (CWE-20), leading to eval injection (CWE-95), as exploited in the wild per CISA KEV.

CVE-2008-5071

Eval injection in PHP program.

CVE-2002-1750

Eval injection in Perl program.

CVE-2008-5305

Eval injection in Perl program using an ID that should only contain hyphens and numbers.

CVE-2002-1752

Direct code injection into Perl eval function.

CVE-2002-1753

Eval injection in Perl program.

CVE-2005-1527

Direct code injection into Perl eval function.

CVE-2005-2837

Direct code injection into Perl eval function.

CVE-2005-1921

MFV. code injection into PHP eval statement using nested constructs that should not be nested.

CVE-2005-2498

MFV. code injection into PHP eval statement using nested constructs that should not be nested.

CVE-2005-3302

Code injection into Python eval statement from a field in a formatted file.

CVE-2007-1253

Eval injection in Python program.

CVE-2001-1471

chain: Resultant eval injection. An invalid value prevents initialization of variables, which can be modified by attacker and later injected into PHP eval statement.

CVE-2007-2713

Chain: Execution after redirect triggers eval injection.

Mogelijke risicobeperkingen

Phases : Architecture and Design // Implementation
If possible, refactor your code so that it does not need to use eval() at all.
Phases : Implementation
Phases : Implementation
Phases : Implementation

Detectiemethoden

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiviteit : High

Notities kwetsbaarheidsmapping

Rechtvaardiging : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Opmerking : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Gerelateerde aanvalspatronen

CAPEC-ID Naam aanvalspatroon
CAPEC-35 Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.

Notities

Factors: special character errors can play a role in increasing the variety of code that can be injected, although some vulnerabilities do not require special characters at all, e.g. when a single function without arguments can be referenced and a terminator character is not necessary.

Referenties

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

REF-1372

How ast.literal_eval can cause memory exhaustion
https://www.reddit.com/r/learnpython/comments/zmbhcf/how_astliteral_eval_can_cause_memory_exhaustion/

REF-1373

ast - Abstract Syntax Trees
https://docs.python.org/3/library/ast.html#ast.literal_eval

Indiening

Naam Organisatie Datum Releasedatum Version
PLOVER 2006-07-19 +00:00 2006-07-19 +00:00 Draft 3

Wijzigingen

Naam Organisatie Datum Opmerking
Eric Dalci Cigital 2008-07-01 +00:00 updated Time_of_Introduction
Veracode 2008-08-15 +00:00 Suggested OWASP Top Ten 2004 mapping
CWE Content Team MITRE 2008-09-08 +00:00 updated Applicable_Platforms, Description, Modes_of_Introduction, Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities
CWE Content Team MITRE 2009-01-12 +00:00 updated Description, Observed_Examples, Other_Notes, Research_Gaps
CWE Content Team MITRE 2009-05-27 +00:00 updated Alternate_Terms, Applicable_Platforms, Demonstrative_Examples, Description, Name, References
CWE Content Team MITRE 2010-02-16 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2010-06-21 +00:00 updated Description, Name
CWE Content Team MITRE 2011-06-01 +00:00 updated Common_Consequences
CWE Content Team MITRE 2012-05-11 +00:00 updated Common_Consequences, Demonstrative_Examples, References, Relationships
CWE Content Team MITRE 2012-10-30 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2013-02-21 +00:00 updated Observed_Examples
CWE Content Team MITRE 2014-07-30 +00:00 updated Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2017-11-08 +00:00 updated Causal_Nature, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2019-01-03 +00:00 updated Taxonomy_Mappings
CWE Content Team MITRE 2019-06-20 +00:00 updated Type
CWE Content Team MITRE 2020-02-24 +00:00 updated Potential_Mitigations, Relationships
CWE Content Team MITRE 2020-06-25 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2021-03-15 +00:00 updated Relationships
CWE Content Team MITRE 2021-10-28 +00:00 updated Relationships
CWE Content Team MITRE 2022-04-28 +00:00 updated Research_Gaps
CWE Content Team MITRE 2022-06-28 +00:00 updated Observed_Examples
CWE Content Team MITRE 2022-10-13 +00:00 updated Observed_Examples
CWE Content Team MITRE 2023-01-31 +00:00 updated Demonstrative_Examples, Description
CWE Content Team MITRE 2023-04-27 +00:00 updated Demonstrative_Examples, Detection_Factors, Relationships, Time_of_Introduction
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2024-02-29 +00:00 updated Demonstrative_Examples, Potential_Mitigations, References
CWE Content Team MITRE 2024-07-16 +00:00 updated Applicable_Platforms, Observed_Examples
CWE Content Team MITRE 2025-04-03 +00:00 updated Common_Consequences, Description, Diagram
CWE Content Team MITRE 2025-12-11 +00:00 updated Demonstrative_Examples, Relationships
De informatie die op CVE Find wordt gepresenteerd, is afkomstig van verschillende zorgvuldig geselecteerde referentiebronnen. CVE-gegevens worden geleverd door MITRE Corporation en de National Vulnerability Database (NVD). De Known Exploited Vulnerabilities (KEV)-catalogus is afkomstig van de Cybersecurity and Infrastructure Security Agency (CISA), terwijl EPSS-scores afkomstig zijn van FIRST.org. Daarnaast worden gegevens over softwarezwakheden (CWE) en veelvoorkomende aanvalspatronen (CAPEC) bijgehouden door MITRE Corporation, en informatie over hardware- en softwareconfiguraties (CPE) wordt geleverd door de NVD.