AAli910913 (Community Member) asked a question.
I'm getting CommandLine Injection CWE ID 78 even after using processBuilder
String fullCommand = "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no " + username + "@" + host + " " + command;
String[] commandArray = fullCommand.split(" ");
ProcessBuilder pb = new ProcessBuilder(commandArray);
Process process = pb.start();
.png){kind=logo}
Hi @AAli910913 (Community Member) ,
Veracode Static Analysis will report CWE 78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) if it can detect that there are strings from outside of the application (HTTP Request, File, Database, webservice, etc.) being used in a command or it's arguments.
We recommend hardcoding allowed inputs and using only hardcoded data in OS commands executed by the application.
If this is not possible and you must allow some dynamic inputs, then we recommend adding strict allowlist validation and proposing a mitigation ( https://docs.veracode.com/r/Propose_Mitigating_Factors_for_a_Flaw ) on this flaw from the Veracode Platform or IDE plugin. In this proposal please describe the controls you have in place to prevent an attacker from abusing this functionality. Then contact your security team to have these proposals reviewed.
Please note that the example above appears to perform arbitrary commands on arbitrary hosts as arbitrary users. This can be extremely dangerous and I would recommend verifying you have appropriate controls over "username" (for example, can only be "alice" or "bob"), host (for example can only be "dev-machine1" or "dev-machine2") and command (for example can only be "rm /var/local/cache/myapp/*").
Fixing this flaw can be deceptively hard. Please consider Scheduling a Consultation ( https://docs.veracode.com/r/t_schedule_consultation ) to meet with one of our Veracode Application Security Consultants to discuss this flaw and any other flaws you'd like to remediate.
Thank you,
Boy Baukema