CWE-74 (输出中的特殊元素转义处理不恰当(注入)) — Vulnerability Class 504

504 vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)). AI Chinese analysis included.

CWE-74 represents a critical input validation weakness where software constructs commands, data structures, or records using externally influenced input without properly neutralizing special elements. This flaw allows attackers to inject malicious syntax that alters the intended interpretation of the downstream component, leading to severe consequences such as unauthorized command execution, data manipulation, or system compromise. Exploitation typically occurs when user-supplied data is directly concatenated into queries or system calls without sanitization. To prevent this, developers must implement rigorous input validation, ensuring all external data is strictly checked against expected formats. Furthermore, utilizing parameterized queries, safe APIs, and context-specific encoding techniques ensures that special characters are treated as literal data rather than executable instructions, effectively neutralizing potential injection vectors before they reach the downstream processor.

MITRE CWE Description

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Common Consequences (5)

Confidentiality Read Application Data

Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.

Access Control Bypass Protection Mechanism

In some cases, injectable code controls authentication; this may lead to a remote vulnerability.

Other Alter Execution Logic

Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.

Integrity, Other Other

Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.

Non-Repudiation Hide Activities

Often the actions performed by injected control code are unlogged.

Mitigations (2)

Requirements Programming languages and supporting technologies might be chosen which are not subject to these issues.

Implementation Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

Examples (2)

This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.

$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);

Bad · PHP

;rm -rf /

Attack

The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.

String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);

Bad · Java

HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...

Result

CVE ID	Title	CVSS	Severity	Published
CVE-2021-32756	Arbitrary eval through MiqExpression — manageiq	8.8	High	2021-07-21
CVE-2021-29084	Synology DiskStation DS418play 注入漏洞 — DiskStation Manager (DSM)	7.5	High	2021-06-23
CVE-2021-29085	Synology DiskStation Manager 注入漏洞 — DiskStation Manager (DSM)	8.6	High	2021-06-23
CVE-2021-32647	Post-authentication Remote Code Execution (RCE) in emissary:emissary — emissary	8.0	High	2021-05-28
CVE-2021-32622	File upload local preview can run embedded scripts after user interaction — matrix-react-sdk	4.2	Medium	2021-05-17
CVE-2021-29502	Remote code execution in the WarnSystem module of Laggrons-Dumb-Cogs — Laggrons-Dumb-Cogs	7.3	High	2021-05-10
CVE-2021-29501	Remote code execution in ticketer — Dav-Cogs	8.1	High	2021-05-10
CVE-2021-21420	Vulnerability in Stripe for Visual Studio Code < 1.7.3 — vscode-stripe	7.5	High	2021-04-01
CVE-2021-21333	HTML injection in email and account expiry notifications — synapse	6.1	Medium	2021-03-26
CVE-2021-24144	Contact Form 7 Database Addon < 1.2.5.6 - CSV Injection — Contact Form 7 Database Addon	8.8	-	2021-03-18
CVE-2021-21381	Sandbox escape via special tokens in .desktop file — flatpak	7.1	High	2021-03-11
CVE-2021-21313	XSS on tabs — glpi	4.9	Medium	2021-03-03
CVE-2021-21353	Remote code execution in pug — pug	6.8	Medium	2021-03-03
CVE-2021-21316	Arbitrary code execution in less-openui5 — less-openui5	6.3	Medium	2021-02-16
CVE-2021-21305	Code Injection vulnerability in CarrierWave — carrierwave	7.4	High	2021-02-08
CVE-2021-21303	Injection attack in Helm — helm	5.9	Medium	2021-02-05
CVE-2021-21277	Angular Expressions - Remote Code Execution — angular-expressions	8.5	High	2021-02-01
CVE-2021-21278	Risk of code injection in RSSHub — RSSHub	8.6	High	2021-01-26
CVE-2021-21263	Query Binding Exploitation in Laravel — framework	7.2	High	2021-01-19
CVE-2021-21247	Post-Auth Unsafe Deserialization on BasePage (AJAX) — onedev	9.6	Critical	2021-01-15
CVE-2021-21249	Post-Auth Unsafe Yaml deserialization — onedev	9.6	Critical	2021-01-15
CVE-2021-21248	Post-Auth Arbitrary Code execution via Groovy script injection — onedev	9.6	Critical	2021-01-15
CVE-2021-21242	Pre-Auth Unsafe Deserialization on AttachmentUploadServet — onedev	10.0	Critical	2021-01-15
CVE-2021-21243	Pre-Auth Unsafe Deserialization on KubernetesResource — onedev	10.0	Critical	2021-01-15
CVE-2021-21244	Pre-Auth SSTI via Bean validation message tampering — onedev	10.0	Critical	2021-01-15
CVE-2021-21261	Flatpak sandbox escape via spawn portal — flatpak	7.3	High	2021-01-14
CVE-2020-26298	Injection in Redcarpet — redcarpet	6.8	Medium	2021-01-11
CVE-2020-27260	Innokas Medical Innokas Yhtyma Oy Vital Signs Monitor 注入漏洞 — BIGCOMPANYSOFT SOFTWARE PRODUCT	5.3	-	2021-01-08
CVE-2020-26293	Possible XSS bypass if style tag is allowed — HtmlSanitizer	6.1	Medium	2021-01-04
CVE-2020-26282	Template Injection in BrowserUp Proxy — browserup-proxy	10.0	Critical	2020-12-24

Vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)) represent 504 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.