Szczegóły CWE-95

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Średni
Incomplete
2006-07-19
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Powiadomienia dla konkretnego CWE
Bądź na bieżąco z wszelkimi zmianami dotyczącymi konkretnego CWE.
Zarządzaj powiadomieniami

Nazwa: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Informacje ogólne

Sposoby wprowadzenia

Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Implementation : This weakness is prevalent in handler/dispatch procedures that might want to invoke a large number of functions, or set a large number of variables.

Odpowiednie platformy

Język

Name: Java (Undetermined)
Name: JavaScript (Undetermined)
Name: Python (Undetermined)
Name: Perl (Undetermined)
Name: PHP (Undetermined)
Name: Ruby (Undetermined)
Class: Interpreted (Undetermined)

Technologie

Name: AI/ML (Undetermined)

Typowe konsekwencje

Zakres Wpływ Prawdopodobieństwo
ConfidentialityRead Files or Directories, Read Application Data

Note: The injected code could access restricted data / files.
Access ControlBypass Protection Mechanism

Note: In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
Access ControlGain Privileges or Assume Identity

Note: Injected code can access resources that the attacker is directly prevented from accessing.
Integrity
Confidentiality
Availability
Other		Execute Unauthorized Code or Commands

Note: Code injection attacks can lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing. Additionally, code injection can often result in the execution of arbitrary code or at least modify what code can be executed.
Non-RepudiationHide Activities

Note: Often the actions performed by injected control code are unlogged.

Zaobserwowane przykłady

Odniesienia Opis

CVE-2024-4181

Framework for LLM applications allows eval injection via a crafted response from a hosting provider.

CVE-2022-2054

Python compiler uses eval() to execute malicious strings as Python code.

CVE-2021-22204

Chain: regex in EXIF processor code does not correctly determine where a string ends (CWE-625), enabling eval injection (CWE-95), as exploited in the wild per CISA KEV.

CVE-2021-22205

Chain: backslash followed by a newline can bypass a validation step (CWE-20), leading to eval injection (CWE-95), as exploited in the wild per CISA KEV.

CVE-2008-5071

Eval injection in PHP program.

CVE-2002-1750

Eval injection in Perl program.

CVE-2008-5305

Eval injection in Perl program using an ID that should only contain hyphens and numbers.

CVE-2002-1752

Direct code injection into Perl eval function.

CVE-2002-1753

Eval injection in Perl program.

CVE-2005-1527

Direct code injection into Perl eval function.

CVE-2005-2837

Direct code injection into Perl eval function.

CVE-2005-1921

MFV. code injection into PHP eval statement using nested constructs that should not be nested.

CVE-2005-2498

MFV. code injection into PHP eval statement using nested constructs that should not be nested.

CVE-2005-3302

Code injection into Python eval statement from a field in a formatted file.

CVE-2007-1253

Eval injection in Python program.

CVE-2001-1471

chain: Resultant eval injection. An invalid value prevents initialization of variables, which can be modified by attacker and later injected into PHP eval statement.

CVE-2007-2713

Chain: Execution after redirect triggers eval injection.

Potencjalne środki zaradcze

Phases : Architecture and Design // Implementation
If possible, refactor your code so that it does not need to use eval() at all.
Phases : Implementation
Phases : Implementation
Phases : Implementation

Metody wykrywania

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Skuteczność : High

Uwagi dotyczące mapowania podatności

Uzasadnienie : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentarz : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Powiązane wzorce ataków

CAPEC-ID Nazwa wzorca ataku
CAPEC-35 Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.

Notatki

Factors: special character errors can play a role in increasing the variety of code that can be injected, although some vulnerabilities do not require special characters at all, e.g. when a single function without arguments can be referenced and a terminator character is not necessary.

Odniesienia

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

REF-1372

How ast.literal_eval can cause memory exhaustion
https://www.reddit.com/r/learnpython/comments/zmbhcf/how_astliteral_eval_can_cause_memory_exhaustion/

REF-1373

ast - Abstract Syntax Trees
https://docs.python.org/3/library/ast.html#ast.literal_eval

Zgłoszenie

Nazwa Organizacja Data Data wydania Version
PLOVER 2006-07-19 +00:00 2006-07-19 +00:00 Draft 3

Modyfikacje

Nazwa Organizacja Data Komentarz
Eric Dalci Cigital 2008-07-01 +00:00 updated Time_of_Introduction
Veracode 2008-08-15 +00:00 Suggested OWASP Top Ten 2004 mapping
CWE Content Team MITRE 2008-09-08 +00:00 updated Applicable_Platforms, Description, Modes_of_Introduction, Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities
CWE Content Team MITRE 2009-01-12 +00:00 updated Description, Observed_Examples, Other_Notes, Research_Gaps
CWE Content Team MITRE 2009-05-27 +00:00 updated Alternate_Terms, Applicable_Platforms, Demonstrative_Examples, Description, Name, References
CWE Content Team MITRE 2010-02-16 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2010-06-21 +00:00 updated Description, Name
CWE Content Team MITRE 2011-06-01 +00:00 updated Common_Consequences
CWE Content Team MITRE 2012-05-11 +00:00 updated Common_Consequences, Demonstrative_Examples, References, Relationships
CWE Content Team MITRE 2012-10-30 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2013-02-21 +00:00 updated Observed_Examples
CWE Content Team MITRE 2014-07-30 +00:00 updated Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2017-11-08 +00:00 updated Causal_Nature, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2019-01-03 +00:00 updated Taxonomy_Mappings
CWE Content Team MITRE 2019-06-20 +00:00 updated Type
CWE Content Team MITRE 2020-02-24 +00:00 updated Potential_Mitigations, Relationships
CWE Content Team MITRE 2020-06-25 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2021-03-15 +00:00 updated Relationships
CWE Content Team MITRE 2021-10-28 +00:00 updated Relationships
CWE Content Team MITRE 2022-04-28 +00:00 updated Research_Gaps
CWE Content Team MITRE 2022-06-28 +00:00 updated Observed_Examples
CWE Content Team MITRE 2022-10-13 +00:00 updated Observed_Examples
CWE Content Team MITRE 2023-01-31 +00:00 updated Demonstrative_Examples, Description
CWE Content Team MITRE 2023-04-27 +00:00 updated Demonstrative_Examples, Detection_Factors, Relationships, Time_of_Introduction
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2024-02-29 +00:00 updated Demonstrative_Examples, Potential_Mitigations, References
CWE Content Team MITRE 2024-07-16 +00:00 updated Applicable_Platforms, Observed_Examples
CWE Content Team MITRE 2025-04-03 +00:00 updated Common_Consequences, Description, Diagram
CWE Content Team MITRE 2025-12-11 +00:00 updated Demonstrative_Examples, Relationships
Informacje prezentowane na CVE Find pochodzą z kilku starannie wybranych źródeł referencyjnych. Dane CVE są dostarczane przez MITRE Corporation i Narodową Bazę Podatności (NVD). Katalog znanych eksploatowanych podatności (KEV) pochodzi z Agencji ds. Bezpieczeństwa Cyberprzestrzeni i Infrastruktury (CISA), natomiast wyniki EPSS pochodzą z FIRST.org. Ponadto dane dotyczące słabości oprogramowania (CWE) i typowych wzorców ataków (CAPEC) są utrzymywane przez MITRE Corporation, a informacje o konfiguracjach sprzętu i oprogramowania (CPE) są dostarczane przez NVD.