SKaulagekar101817 (Community Member) asked a question.
The flaw is at Runtime.getRuntime().exec(cmd, env) method. We have validated the input using OWASP ESAPI.
But Veracode still reports OS command injection flaw.
Old Code:
public Process exec(String[] cmd, String[] env) throws IOException {
return Runtime.getRuntime().exec(cmd, env);
}
New Code:
public Process exec(String[] cmd, String[] env) throws IOException {
String[] newCmdArr = new String[cmd.length];
String[] newEnvArr = new String[env.length];
for(int i=0;i<env.length;i++)
{
newEnvArr[i] = CSSecurity.getValidInput(ESAPIContext.OSCommand, env[i], ESAPIType.OSCommand);
}
for ( int i = 0; i < cmd.length; i++ )
{
newCmdArr[i] = CSSecurity.getValidInput(ESAPIContext.OSCommand, cmd[i], ESAPIType.OSCommand);
}
return Runtime.getRuntime().exec(newCmdArr, newEnvArr);
}
.png){kind=logo}
Hi @SKaulagekar101817 (Community Member),
Thanks for your question.
Veracode Static Analysis will report CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) if it can detect that there are strings from outside of the application (HTTP Request, File, Database, webservice, etc.) being used when constructing a command or it's arguments.
We recommend hardcoding allowed inputs and using only hardcoded data in OS commands executed by the application. If this is not possible and you must allow some dynamic inputs, then we recommend adding strict allow-list validation and proposing a mitigation ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ ) on this flaw from the Veracode Platform or IDE plugin. In this proposal please describe the controls you have in place to prevent an attacker from abusing this functionality. Then contact your security team to have these proposals reviewed.
I cannot see what CSSecurity.getValidInput() does so it is hard to provide any specific guidance. You may also wish to schedule a consultation to discuss this further with our Application Security Consultants. You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Please let me know if you have any remaining questions or concerns.
Thanks,
Anthony Fielding
@Anthony Fielding My input string is dynamic from HTTP request, in this case how to resolve Command or Argument Injection?
Hi @HKothapally735659 (Community Member) thanks for your reply. A consultation call will likely be the best avenue to discuss this further if you need specific help, as previously mentioned. Alternatively if you must permit the command or it's arguments to be set via the HTTP request then the best route would be maintain an array of permitted commands and argument combinations and ensure all untrusted inputs are strictly validated against those lists. This is an allow-list based approach. Every user-supplied component must be thoroughly validated only using allow-list based validations that are appropriate for the context. At present if an attacker could interact with this via HTTP they may be able to potentially inject malicious commands to execute, either via the command argument or the command it's self. Be mindful that even with validation in place e.g. regex of [a-z], an attacker could potentially pick the program they want to run ('ls', 'id', 'whoami', 'ping', ...). This is why the entire binary path must be fully validated, and with a fully-qualified path e.g. "/usr/bin/some-binary-name".
Thanks,
Anthony Fielding