Tên: Improper Neutralization of Directives in Dynamically Evaluated Code

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Thông tin chung

Các cách xuất hiện

Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Implementation : This weakness is prevalent in handler/dispatch procedures that might want to invoke a large number of functions, or set a large number of variables.

Nền tảng áp dụng

Ngôn ngữ

Tên: Java (Undetermined)
Tên: JavaScript (Undetermined)
Tên: Python (Undetermined)
Tên: Perl (Undetermined)
Tên: PHP (Undetermined)
Tên: Ruby (Undetermined)
Lớp: Interpreted (Undetermined)

Công nghệ

Tên: AI/ML (Often)

Hậu quả phổ biến

Phạm vi	Tác động	Khả năng xảy ra
Confidentiality	Read Files or Directories, Read Application Data Ghi chú: The injected code could access restricted data / files.
Access Control	Bypass Protection Mechanism Ghi chú: In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
Access Control	Gain Privileges or Assume Identity Ghi chú: Injected code can access resources that the attacker is directly prevented from accessing.
Integrity Confidentiality Availability Other	Execute Unauthorized Code or Commands Ghi chú: Code injection attacks can lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing. Additionally, code injection can often result in the execution of arbitrary code or at least modify what code can be executed.
Non-Repudiation	Hide Activities Ghi chú: Often the actions performed by injected control code are unlogged.

Ví dụ đã quan sát

Tài liệu tham khảo	Mô tả
CVE-2024-4181	Framework for LLM applications allows eval injection via a crafted response from a hosting provider.
CVE-2022-2054	Python compiler uses eval() to execute malicious strings as Python code.
CVE-2021-22204	Chain: regex in EXIF processor code does not correctly determine where a string ends (CWE-625), enabling eval injection (CWE-95), as exploited in the wild per CISA KEV.
CVE-2021-22205	Chain: backslash followed by a newline can bypass a validation step (CWE-20), leading to eval injection (CWE-95), as exploited in the wild per CISA KEV.
CVE-2008-5071	Eval injection in PHP program.
CVE-2002-1750	Eval injection in Perl program.
CVE-2008-5305	Eval injection in Perl program using an ID that should only contain hyphens and numbers.
CVE-2002-1752	Direct code injection into Perl eval function.
CVE-2002-1753	Eval injection in Perl program.
CVE-2005-1527	Direct code injection into Perl eval function.
CVE-2005-2837	Direct code injection into Perl eval function.
CVE-2005-1921	MFV. code injection into PHP eval statement using nested constructs that should not be nested.
CVE-2005-2498	MFV. code injection into PHP eval statement using nested constructs that should not be nested.
CVE-2005-3302	Code injection into Python eval statement from a field in a formatted file.
CVE-2007-1253	Eval injection in Python program.
CVE-2001-1471	Chain: Resultant eval injection. An invalid value prevents initialization of variables, which can be modified by attacker and later injected into PHP eval statement.

Các biện pháp giảm thiểu tiềm năng

Phases : Architecture and Design // Implementation
If possible, refactor your code so that it does not need to use eval() at all.
Phases : Implementation
Phases : Implementation
Phases : Implementation

Phương pháp phát hiện

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Hiệu quả : High

Ghi chú ánh xạ lỗ hổng

Lý do : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Mẫu tấn công liên quan

ID CAPEC	Tên mẫu tấn công
CAPEC-35	Leverage Executable Code in Non-Executable Files An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.

Ghi chú

Factors: special character errors can play a role in increasing the variety of code that can be injected, although some vulnerabilities do not require special characters at all, e.g. when a single function without arguments can be referenced and a terminator character is not necessary.

Tài liệu tham khảo

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

REF-1372

How ast.literal_eval can cause memory exhaustion
https://www.reddit.com/r/learnpython/comments/zmbhcf/how_astliteral_eval_can_cause_memory_exhaustion/

REF-1373

ast - Abstract Syntax Trees
https://docs.python.org/3/library/ast.html#ast.literal_eval

Gửi

Tên	Tổ chức	Ngày	Ngày phát hành	Version
PLOVER		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

Sửa đổi

Tên	Tổ chức	Ngày	Bình luận
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
	Veracode	2008-08-15 +00:00	Suggested OWASP Top Ten 2004 mapping
CWE Content Team	MITRE	2008-09-08 +00:00	updated Applicable_Platforms, Description, Modes_of_Introduction, Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities
CWE Content Team	MITRE	2009-01-12 +00:00	updated Description, Observed_Examples, Other_Notes, Research_Gaps
CWE Content Team	MITRE	2009-05-27 +00:00	updated Alternate_Terms, Applicable_Platforms, Demonstrative_Examples, Description, Name, References
CWE Content Team	MITRE	2010-02-16 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2010-06-21 +00:00	updated Description, Name
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Common_Consequences, Demonstrative_Examples, References, Relationships
CWE Content Team	MITRE	2012-10-30 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2013-02-21 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2017-11-08 +00:00	updated Causal_Nature, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2019-01-03 +00:00	updated Taxonomy_Mappings
CWE Content Team	MITRE	2019-06-20 +00:00	updated Type
CWE Content Team	MITRE	2020-02-24 +00:00	updated Potential_Mitigations, Relationships
CWE Content Team	MITRE	2020-06-25 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2021-03-15 +00:00	updated Relationships
CWE Content Team	MITRE	2021-10-28 +00:00	updated Relationships
CWE Content Team	MITRE	2022-04-28 +00:00	updated Research_Gaps
CWE Content Team	MITRE	2022-06-28 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2022-10-13 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2023-01-31 +00:00	updated Demonstrative_Examples, Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Demonstrative_Examples, Detection_Factors, Relationships, Time_of_Introduction
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2024-02-29 +00:00	updated Demonstrative_Examples, Potential_Mitigations, References
CWE Content Team	MITRE	2024-07-16 +00:00	updated Applicable_Platforms, Observed_Examples
CWE Content Team	MITRE	2025-04-03 +00:00	updated Common_Consequences, Description, Diagram
CWE Content Team	MITRE	2025-12-11 +00:00	updated Demonstrative_Examples, Relationships
CWE Content Team	MITRE	2026-04-30 +00:00	updated Applicable_Platforms, Potential_Mitigations, Relationships
CWE Content Team	MITRE	2026-10-28 +00:00	updated Alternate_Terms, Name, Observed_Examples

Chi tiết CWE-95

CWE-95