目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-78 OS命令中使用的特殊元素转义处理不恰当(OS命令注入) 类漏洞列表 3458

CWE-78 OS命令中使用的特殊元素转义处理不恰当(OS命令注入) 类弱点 3458 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-78即操作系统命令注入，属于输入验证缺陷。攻击者通过构造包含特殊字符的恶意输入，诱导程序拼接出非预期的系统命令，从而在服务器上执行任意代码。开发者应避免直接使用用户输入拼接命令，转而采用白名单过滤、参数化调用或安全API，确保外部数据仅作为参数而非命令结构的一部分，从根本上阻断注入路径。

MITRE CWE 官方描述
CWE：CWE-78 OS命令中特殊元素的不当中和（'OS Command Injection'） 英文：产品使用来自上游组件的外部影响输入来构建OS命令的全部或部分内容，但在将命令发送给下游组件时，未对可能修改预期OS命令的特殊元素进行中和或进行了错误的中和。 这种弱点可能导致在攻击者无法直接访问操作系统的环境中产生漏洞，例如在Web应用程序中。或者，如果该弱点出现在特权程序中，它可能允许攻击者指定通常无法访问的命令，或以攻击者不具备的特权调用备用命令。如果受影响的进程不遵循最小特权原则，问题会进一步加剧，因为攻击者控制的命令可能会以特殊的系统特权运行，从而增加损害程度。OS命令注入至少有两种子类型：应用程序意图执行一个单一的、固定的、由其自身控制程序。它意图使用外部提供的输入作为该程序的参数。例如，程序可能使用 system("nslookup [HOSTNAME]") 来运行 nslookup 并允许用户提供一个 HOSTNAME，该 HOSTNAME 用作参数。攻击者无法阻止 nslookup 的执行。然而，如果程序未从 HOSTNAME 参数中移除命令分隔符，攻击者可以将分隔符放入参数中，从而允许他们在 nslookup 执行完毕后执行自己的程序。应用程序接受一个输入，该输入用于完全选择要运行的程序以及要使用的命令。应用程序只是将整个命令重定向到操作系统。例如，程序可能使用 "exec([COMMAND])" 来执行由用户提供的 [COMMAND]。如果 COMMAND 处于攻击者控制之下，那么攻击者可以执行任意命令或程序。如果使用 exec() 和 CreateProcess() 等函数执行命令，攻击者可能无法在同一行中组合多个命令。从弱点角度来看，这些变体代表了不同的程序员错误。在第一种变体中，程序员显然意图让来自不受信任方的输入成为要执行的命令中的参数的一部分。在第二种变体中，程序员无意让命令对任何不受信任的方开放，但程序员可能未考虑到恶意攻击者提供输入的其他方式。
常见影响 (1)
Confidentiality, Integrity, Availability, Non-Repudiation Execute Unauthorized Code or Commands, DoS: Crash, Exit, or Restart, Read Files or Directories, Modify Files or Directories, Read Application Data, Modify Application Data, Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any…
缓解措施 (5)
Architecture and Design If at all possible, use library calls rather than external processes to recreate the desired functionality.
Architecture and Design, Operation Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For ex…
Effectiveness: Limited
Architecture and Design For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.
Architecture and Design For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Architecture and Design Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error.
代码示例 (2)
This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);
Bad · PHP
;rm -rf /
Attack
The following simple program accepts a filename as a command line argument and displays the contents of the file back to the user. The program is installed setuid root because it is intended for use as a learning tool to allow system administrators in-training to inspect privileged system files without giving them the ability to modify them or damage the system.
int main(int argc, char** argv) { char cmd[CMD_MAX] = "/usr/bin/cat "; strcat(cmd, argv[1]); system(cmd); }
Bad · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2019-1878 Cisco TelePresence Codec和Collaboration Endpoint Software 操作系统命令注入漏洞 — Cisco TelePresence TC Software 8.8 - 2019-06-20
CVE-2019-1879 Cisco Integrated Management Controller 操作系统命令注入漏洞 — Cisco Unified Computing System (Management Software) 6.7 - 2019-06-20
CVE-2019-1627 Cisco Integrated Management Controller 信息泄露漏洞 — Cisco Unified Computing System (Management Software) 6.5 - 2019-06-20
CVE-2019-10149 Exim 操作系统命令注入漏洞 — exim 9.8 - 2019-06-05
CVE-2019-6739 Malwarebytes Anti-Malware 命令注入漏洞 — Antimalware 8.8 - 2019-06-03
CVE-2019-1778 Cisco NX-OS Software 操作系统命令注入漏洞 — Cisco NX-OS Software 6.7 - 2019-05-15
CVE-2019-1774 Cisco NX-OS Software 操作系统命令注入漏洞 — Cisco NX-OS Software 6.7 - 2019-05-15
CVE-2019-1775 Cisco NX-OS Software 操作系统命令注入漏洞 — Cisco NX-OS Software 6.7 - 2019-05-15
CVE-2019-1776 Cisco NX-OS Software 操作系统命令注入漏洞 — Cisco NX-OS Software 6.7 - 2019-05-15
CVE-2019-1769 Cisco NX-OS Software 操作系统命令注入漏洞 — Cisco NX-OS Software 6.7 - 2019-05-15
CVE-2019-1770 Cisco NX-OS Software 操作系统命令注入漏洞 — Cisco NX-OS Software 6.7 - 2019-05-15
CVE-2019-1732 Cisco NX-OS Software Remote Package Manager子系统操作系统命令注入漏洞 — Cisco NX-OS Software 6.4 - 2019-05-15
CVE-2019-1709 Cisco Firepower Threat Defense 操作系统命令注入漏洞 — Cisco Firepower Threat Defense Software 7.8 - 2019-05-03
CVE-2019-1699 Cisco Firepower Threat Defense 操作系统命令注入漏洞 — Cisco Firepower Threat Defense (FTD) Software 7.8 - 2019-05-03
CVE-2019-1725 Cisco UCS B-Series Blade Servers 操作系统命令注入漏洞 — Cisco UCS B-Series Blade Server Software 5.5 - 2019-04-18
CVE-2019-10880 多款Xerox产品操作系统命令注入漏洞 — AltaLink B8045/B8055/B8065/B8075/B8090 9.8 - 2019-04-12
CVE-2018-13285 Synology Router Manager 操作系统命令注入漏洞 — Synology Router Manager (SRM) 8.8 - 2019-04-01
CVE-2018-13284 Synology DiskStation Manager 操作系统命令注入漏洞 — DiskStation Manager (DSM) 8.8 - 2019-04-01
CVE-2019-1745 Cisco IOS XE 操作系统命令注入漏洞 — Cisco IOS XE Software 7.8 - 2019-03-27
CVE-2018-20106 yast2-printer 输入验证错误漏洞 — yast2-printer 8.1 - 2019-03-15
CVE-2019-3919 Nokia Alcatel Lucent I-240W-Q GPON ONT 命令注入漏洞 — Alcatel Lucent I-240W-Q GPON ONT 8.8 - 2019-03-05
CVE-2019-3920 Nokia Alcatel Lucent I-240W-Q GPON ONT 命令注入漏洞 — Alcatel Lucent I-240W-Q GPON ONT 8.8 - 2019-03-05
CVE-2018-19639 SUSE Supportutils 命令注入漏洞 — supportutils 8.4 - 2019-03-05
CVE-2019-1674 Cisco Webex Meetings Desktop App和Cisco Webex Productivity Tools 操作系统命令注入漏洞 — Cisco Webex Meetings Desktop App 7.8 - 2019-02-28
CVE-2018-15380 Cisco HyperFlex Software 操作系统命令注入漏洞 — Cisco HyperFlex HX-Series 8.8 - 2019-02-20
CVE-2018-17707 Epic Games Launcher 安全漏洞 — Epic Games Launcher 8.8 - 2019-01-24
CVE-2019-1636 Cisco Webex Teams 操作系统命令注入漏洞 — Cisco Webex Teams 8.8 - 2019-01-23
CVE-2018-6342 react-dev-utils 安全漏洞 — react-dev-utils 9.8 - 2018-12-31
CVE-2018-15722 Logitech Harmony Hub 操作系统命令注入漏洞 — Logitech Harmony Hub 8.1 - 2018-12-20
CVE-2018-19007 Geutebrück E2 Camera Series 操作系统命令注入漏洞 — Geutebrück GmbH E2 Camera Series versions prior to 1.12.0.25 9.8 - 2018-12-14

CWE-78（OS命令中使用的特殊元素转义处理不恰当(OS命令注入)） 是常见的弱点类别，本平台收录该类弱点关联的 3458 条 CVE 漏洞。