VVasiuk108506 (Community Member) asked a question.
How to fix in python CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
I am trying to call a subprocess in python with a string cmd which has sone variables:
cmd = f"some_command | tar -x -C {my_path)}"
res = subprocess.run(cmd, shell=True, stderr=subprocess.PIPE, stdout=subprocess.PIPE)
And my veracode scan tells me its a CWE-78. How canI fix this?
Thanks.
.png){kind=logo}
Hi @VVasiuk108506 (Community Member),
The concern here is that if `some_command` contains malicious data, then an attacker could run any OS command.
The context in which your application is significant. For instance, if the application is a web server, then an attacker would be able to carry out a Remote Code Execution (RCE) attack. However, if this is a script that is run on a local machine by someone with full administrative rights, it is unlikely there is anything they can do via the script they could not do otherwise.
If this is a web server or similar, I strongly recommend looking at alternatives to running an OS command directly. If there really is no other choice, you may wish to refer to this guide about OS Command Injection defences.
Kind regards,
Duncan