CWE-74 (输出中的特殊元素转义处理不恰当(注入)) — Vulnerability Class 504

504 vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)). AI Chinese analysis included.

CWE-74 represents a critical input validation weakness where software constructs commands, data structures, or records using externally influenced input without properly neutralizing special elements. This flaw allows attackers to inject malicious syntax that alters the intended interpretation of the downstream component, leading to severe consequences such as unauthorized command execution, data manipulation, or system compromise. Exploitation typically occurs when user-supplied data is directly concatenated into queries or system calls without sanitization. To prevent this, developers must implement rigorous input validation, ensuring all external data is strictly checked against expected formats. Furthermore, utilizing parameterized queries, safe APIs, and context-specific encoding techniques ensures that special characters are treated as literal data rather than executable instructions, effectively neutralizing potential injection vectors before they reach the downstream processor.

MITRE CWE Description

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Common Consequences (5)

Confidentiality Read Application Data

Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.

Access Control Bypass Protection Mechanism

In some cases, injectable code controls authentication; this may lead to a remote vulnerability.

Other Alter Execution Logic

Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.

Integrity, Other Other

Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.

Non-Repudiation Hide Activities

Often the actions performed by injected control code are unlogged.

Mitigations (2)

Requirements Programming languages and supporting technologies might be chosen which are not subject to these issues.

Implementation Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

Examples (2)

This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.

$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);

Bad · PHP

;rm -rf /

Attack

The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.

String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);

Bad · Java

HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...

Result

CVE ID	Title	CVSS	Severity	Published
CVE-2022-24838	Command Injection in Appointment Emails for Nextcloud Calendar — security-advisories	5.3	Medium	2022-04-11
CVE-2022-24832	Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames — gocd	8.2	High	2022-04-11
CVE-2022-1074	TEM FLEX-1085 injection — FLEX-1085	4.3	Medium	2022-03-29
CVE-2022-20001	Injection in fish — fish-shell	7.8	High	2022-03-14
CVE-2022-24760	Command Injection in Parse server — parse-server	10.0	Critical	2022-03-11
CVE-2022-21705	Authenticated remote code execution in octobercms — october	7.2	High	2022-02-23
CVE-2022-23616	Remote code execution in xwiki-platform — xwiki-platform	8.8	High	2022-02-09
CVE-2022-0391	Python 注入漏洞 — python	7.5	-	2022-02-09
CVE-2021-43929	Synology DiskStation Manager 跨站脚本漏洞 — DiskStation Manager (DSM)	6.5	Medium	2022-02-07
CVE-2022-23614	Code injection in Twig — Twig	8.8	High	2022-02-04
CVE-2021-32649	Authenticated file write leads to remote code execution in october/system — october	8.8	High	2022-01-14
CVE-2021-32650	Arbitrary code execution in october/system — october	8.8	High	2022-01-14
CVE-2021-29454	Sandbox Escape by math function in smarty — smarty	8.1	High	2022-01-10
CVE-2022-21663	Authenticated Object Injection in Multisites in WordPress — wordpress-develop	6.6	Medium	2022-01-06
CVE-2021-43852	JavaScript Prototype Pollution in oro/platform — platform	8.8	High	2022-01-04
CVE-2021-25994	Userfrosting - Host-Header Injection Leads to Account Takeover — userfrosting	8.8	High	2022-01-03
CVE-2021-43837	Template injection in vault-cli — vault-cli	8.4	High	2021-12-16
CVE-2021-41276	Indirect LDAP injection in Tuleap — tuleap	6.7	Medium	2021-12-15
CVE-2021-43818	HTML Cleaner allows crafted and SVG embedded scripts to pass through — lxml	8.2	High	2021-12-13
CVE-2021-36313	Dell EMC CloudLink 操作系统命令注入漏洞 — CloudLink	9.1	Critical	2021-11-23
CVE-2021-25980	Talkyard - Host-Header Injection Leads to Account Takeover — talkyard	8.8	High	2021-11-11
CVE-2021-38294	Shell Command Injection Vulnerability in Nimbus Thrift Server — Apache Storm	9.8	-	2021-10-25
CVE-2021-41163	RCE via malicious SNS subscription payload — discourse	10.0	Critical	2021-10-20
CVE-2021-38458	Moxa MXview Network Management Software — MXview Network Management Software	9.8	Critical	2021-10-12
CVE-2021-41128	CSV Injection Vulnerability in Hygeia — hygeia	9.1	Critical	2021-10-06
CVE-2021-39213	IP restriction on GLPI API Bypass with custom header injection — glpi	6.8	Medium	2021-09-15
CVE-2021-39187	Crash server with query parameter — parse-server	7.5	High	2021-09-02
CVE-2021-39175	XSS vector in slide mode speaker-view — hedgedoc	8.1	High	2021-08-30
CVE-2021-32827	Arbitrary code execution in MockServer — mockserver	6.1	Medium	2021-08-16
CVE-2021-21580	DELL Dell EMC iDRAC9 和 Dell EMC iDRAC8 注入漏洞 — Integrated Dell Remote Access Controller (iDRAC)	4.3	Medium	2021-08-03

Vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)) represent 504 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.