CISA KEVC :: 2026-10-15
Report Window: 2026-10-15 to 2026-10-8
| Scoring Source | CRITICAL | HIGH | MEDIUM | LOW | ||||
|---|---|---|---|---|---|---|---|---|
| Today | L7D | Today | L7D | Today | L7D | Today | L7D | |
| EPSS | 0 | 3 | 0 | 0 | 0 | 0 | 0 | 6 |
| CVSS v4.0 | 0 | 1 | 0 | 1 | 0 | 1 | 0 | 0 |
| CVSS v3.1 | 0 | 4 | 0 | 5 | 0 | 1 | 0 | 0 |
| CVSS v3.0 | 0 | 0 | 0 | 1 | 0 | 0 | 0 | 0 |
| CVSS v2.0 | 0 | 0 | 0 | 6 | 0 | 0 | 0 | 0 |
Today / Last 7 Days count, by severity and scoring source.
CVEs (Today)
0
CVEs (L7D)
11
CWEs (Today)
0
CWEs (L7D)
10
CISA Catalog of Known Exploited Vulnerabilities
Individual vulnerabilities confirmed as actively exploited, with EPSS and CVSS scoring by source.
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
EPSS
CRITICAL
0.97
CVSS v3.1
CRITICAL
10.00
CVSS v2.0
HIGH
10.00
Date Added: 2026-10-08
Description
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS v3.1
| Source | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Type | Secondary |
|---|---|---|---|
| Base Score | 10.0 | Base Severity | CRITICAL |
| Attack Vector | NETWORK | Attack Complexity | LOW |
| Privileges Req. | NONE | User Interaction | NONE |
| Scope | CHANGED | Confidentiality | HIGH |
| Integrity | HIGH | Availability | HIGH |
| Exploitability | 3.9 | Impact Score | 6.0 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | ||
Status:
Undergoing Analysis
| Vendor: |
| ProFTPD |
| Product: |
| ProFTPD |
| EPSS: |
| 0.967520000 |
| Percentile: |
| 0.998870000 |
| Related CWEs: |
| CWE-284 |
CVE-2015-5477
ISC BIND Data Processing Errors Vulnerability
EPSS
CRITICAL
0.91
CVSS v3.1
HIGH
7.50
CVSS v2.0
HIGH
7.80
Date Added: 2026-10-08
Description
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS v3.1
| Source | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Type | Secondary |
|---|---|---|---|
| Base Score | 7.5 | Base Severity | HIGH |
| Attack Vector | NETWORK | Attack Complexity | LOW |
| Privileges Req. | NONE | User Interaction | NONE |
| Scope | UNCHANGED | Confidentiality | NONE |
| Integrity | NONE | Availability | HIGH |
| Exploitability | 3.9 | Impact Score | 3.6 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | ||
Status:
Modified
| Vendor: |
| ISC |
| Product: |
| BIND |
| EPSS: |
| 0.912840000 |
| Percentile: |
| 0.998100000 |
| Related CWEs: |
| CWE-19 |
CVE-2016-3081
Apache Struts Command Injection Vulnerability
EPSS
CRITICAL
0.93
CVSS v3.1
HIGH
8.10
CVSS v3.0
HIGH
8.10
CVSS v2.0
HIGH
9.30
Date Added: 2026-10-08
Description
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS v3.1
| Source | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Type | Secondary |
|---|---|---|---|
| Base Score | 8.1 | Base Severity | HIGH |
| Attack Vector | NETWORK | Attack Complexity | HIGH |
| Privileges Req. | NONE | User Interaction | NONE |
| Scope | UNCHANGED | Confidentiality | HIGH |
| Integrity | HIGH | Availability | HIGH |
| Exploitability | 2.2 | Impact Score | 5.9 |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | ||
Status:
Modified
| Vendor: |
| Apache |
| Product: |
| Struts |
| EPSS: |
| 0.933520000 |
| Percentile: |
| 0.998380000 |
| Related CWEs: |
| CWE-77 |
CVE-2021-3199
ONLYOFFICE Docs Server Path Traversal Vulnerability
EPSS
LOW
0.08
CVSS v3.1
CRITICAL
9.80
CVSS v2.0
HIGH
7.50
Date Added: 2026-10-08
Description
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS v3.1
| Source | nvd@nist.gov | Type | Primary |
|---|---|---|---|
| Base Score | 9.8 | Base Severity | CRITICAL |
| Attack Vector | NETWORK | Attack Complexity | LOW |
| Privileges Req. | NONE | User Interaction | NONE |
| Scope | UNCHANGED | Confidentiality | HIGH |
| Integrity | HIGH | Availability | HIGH |
| Exploitability | 3.9 | Impact Score | 5.9 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | ||
| Source | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Type | Secondary |
|---|---|---|---|
| Base Score | 9.8 | Base Severity | CRITICAL |
| Attack Vector | NETWORK | Attack Complexity | LOW |
| Privileges Req. | NONE | User Interaction | NONE |
| Scope | UNCHANGED | Confidentiality | HIGH |
| Integrity | HIGH | Availability | HIGH |
| Exploitability | 3.9 | Impact Score | 5.9 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | ||
Status:
Modified
| Vendor: |
| ONLYOFFICE |
| Product: |
| Docs |
| EPSS: |
| 0.082150000 |
| Percentile: |
| 0.947500000 |
| Related CWEs: |
| CWE-22 |
CVE-2023-22894
Strapi Cleartext Storage of Sensitive Information Vulnerability
EPSS
LOW
0.02
CVSS v3.1
MEDIUM
4.90
Date Added: 2026-10-08
Description
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS v3.1
| Source | nvd@nist.gov | Type | Primary |
|---|---|---|---|
| Base Score | 4.9 | Base Severity | MEDIUM |
| Attack Vector | NETWORK | Attack Complexity | LOW |
| Privileges Req. | HIGH | User Interaction | NONE |
| Scope | UNCHANGED | Confidentiality | HIGH |
| Integrity | NONE | Availability | NONE |
| Exploitability | 1.2 | Impact Score | 3.6 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | ||
| Source | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Type | Secondary |
|---|---|---|---|
| Base Score | 7.2 | Base Severity | HIGH |
| Attack Vector | NETWORK | Attack Complexity | LOW |
| Privileges Req. | HIGH | User Interaction | NONE |
| Scope | UNCHANGED | Confidentiality | HIGH |
| Integrity | HIGH | Availability | HIGH |
| Exploitability | 1.2 | Impact Score | 5.9 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | ||
Status:
Undergoing Analysis
| Vendor: |
| Strapi |
| Product: |
| Strapi |
| EPSS: |
| 0.016580000 |
| Percentile: |
| 0.759100000 |
| Related CWEs: |
| CWE-312 |
CVE-2026-0322
Palo Alto Networks PAN-OS Code Injection Vulnerability
CVSS v4.0
HIGH
8.60
Date Added: 2026-10-14
Description
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS v4.0
| Source | psirt@paloaltonetworks.com | Type | Secondary |
|---|---|---|---|
| Base Score | 8.6 | Base Severity | HIGH |
| Attack Vector | NETWORK | Attack Complexity | LOW |
| Privileges Req. | HIGH | User Interaction | NONE |
| Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red | ||
CVE-2026-104935
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
EPSS
LOW
0.26
CVSS v3.1
HIGH
8.60
Date Added: 2026-10-13
Description
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS v3.1
| Source | 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 | Type | Secondary |
|---|---|---|---|
| Base Score | 8.6 | Base Severity | HIGH |
| Attack Vector | NETWORK | Attack Complexity | LOW |
| Privileges Req. | NONE | User Interaction | NONE |
| Scope | UNCHANGED | Confidentiality | HIGH |
| Integrity | LOW | Availability | LOW |
| Exploitability | 3.9 | Impact Score | 4.7 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L | ||
Status:
Analyzed
| Vendor: |
| Ivanti |
| Product: |
| Connect Secure |
| EPSS: |
| 0.259820000 |
| Percentile: |
| 0.979610000 |
| Related CWEs: |
| CWE-290 |
CVE-2026-105133
Ahsay AhsayCBS Improper Authentication Vulnerability
EPSS
LOW
0.00
CVSS v4.0
MEDIUM
5.50
CVSS v3.1
HIGH
7.30
CVSS v2.0
HIGH
7.50
Date Added: 2026-10-14
Description
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS v3.1
| Source | cna@vuldb.com | Type | Secondary |
|---|---|---|---|
| Base Score | 7.3 | Base Severity | HIGH |
| Attack Vector | NETWORK | Attack Complexity | LOW |
| Privileges Req. | NONE | User Interaction | NONE |
| Scope | UNCHANGED | Confidentiality | LOW |
| Integrity | LOW | Availability | LOW |
| Exploitability | 3.9 | Impact Score | 3.4 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | ||
Status:
Undergoing Analysis
| Vendor: |
| Ahsay |
| Product: |
| AhsayCBS |
| EPSS: |
| 0.003830000 |
| Percentile: |
| 0.306720000 |
| Related CWEs: |
| CWE-287 |
CVE-2026-105134
Ahsay AhsayCBS Command Injection Vulnerability
EPSS
LOW
0.02
CVSS v4.0
CRITICAL
9.30
CVSS v3.1
CRITICAL
10.00
CVSS v2.0
HIGH
10.00
Date Added: 2026-10-14
Description
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS v3.1
| Source | cna@vuldb.com | Type | Secondary |
|---|---|---|---|
| Base Score | 10.0 | Base Severity | CRITICAL |
| Attack Vector | NETWORK | Attack Complexity | LOW |
| Privileges Req. | NONE | User Interaction | NONE |
| Scope | CHANGED | Confidentiality | HIGH |
| Integrity | HIGH | Availability | HIGH |
| Exploitability | 3.9 | Impact Score | 6.0 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | ||
CVE-2026-76519
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
CVSS v3.1
CRITICAL
9.80
Date Added: 2026-10-14
Description
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS v3.1
| Source | psirt@cisco.com | Type | Secondary |
|---|---|---|---|
| Base Score | 9.8 | Base Severity | CRITICAL |
| Attack Vector | NETWORK | Attack Complexity | LOW |
| Privileges Req. | NONE | User Interaction | NONE |
| Scope | UNCHANGED | Confidentiality | HIGH |
| Integrity | HIGH | Availability | HIGH |
| Exploitability | 3.9 | Impact Score | 5.9 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | ||
Status:
Undergoing Analysis
| Vendor: |
| Cisco |
| Product: |
| Secure Email Gateway |
| EPSS: |
| Percentile: |
| Related CWEs: |
| CWE-23 |
CVE-2026-96951
Microsoft Windows Command Injection Vulnerability
EPSS
LOW
0.02
CVSS v3.1
HIGH
8.80
Date Added: 2026-10-13
Description
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS v3.1
| Source | secure@microsoft.com | Type | Secondary |
|---|---|---|---|
| Base Score | 8.8 | Base Severity | HIGH |
| Attack Vector | NETWORK | Attack Complexity | LOW |
| Privileges Req. | NONE | User Interaction | REQUIRED |
| Scope | UNCHANGED | Confidentiality | HIGH |
| Integrity | HIGH | Availability | HIGH |
| Exploitability | 2.8 | Impact Score | 5.9 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | ||
Status:
Analyzed
| Vendor: |
| Microsoft |
| Product: |
| Windows |
| EPSS: |
| 0.015060000 |
| Percentile: |
| 0.738470000 |
| Related CWEs: |
| CWE-77 |
Common Weakness Enumeration
The underlying weakness patterns behind the vulnerabilities above — root-cause categories, not individual exploits.
CWE-19
Description
| Referenced By CVEs: |
| CVE-2015-5477 |
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Status: Stable
Description
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Diagram
Alternate Terms
| Term | Description |
|---|---|
| Path traversal | "Path traversal" is preferred over "directory traversal," but both terms are attack-focused. |
| Directory traversal | |
| Path transversal | an alternate phrasing of "path traversal" |
Applicable Platforms
| Type | Name | Prevalence |
|---|---|---|
| Language | Not Language-Specific | Undetermined |
| Technology | AI/ML | Often |
Common Consequences
| Scope | Impact | Note |
|---|---|---|
| Integrity, Confidentiality, Availability | Execute Unauthorized Code or Commands | The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries. |
| Integrity | Modify Files or Directories | The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication. |
| Confidentiality | Read Files or Directories | The attacker may be able read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system. |
| Availability | DoS: Crash, Exit, or Restart | The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of protection mechanisms such as authentication, it has the potential to lock out product users. |
Potential Mitigations
| Phase | Description |
|---|---|
| Implementation | Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright. When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434. Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string. |
| Architecture and Design | For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server. |
| Implementation | Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked. Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23, CWE-59). This includes: - realpath() in C - getCanonicalPath() in Java - GetFullPath() in ASP.NET - realpath() or abs_path() in Perl - realpath() in PHP |
| Architecture and Design | Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. |
| Operation | Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481]. |
| Architecture and Design, Operation | Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations. |
| Architecture and Design | When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-185] provide this capability. |
| Architecture and Design, Operation | Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails. |
| Architecture and Design, Operation | Store library, include, and utility files outside of the web document root, if possible. Otherwise, store them in a separate directory and use the web server's access control capabilities to prevent attackers from directly requesting them. One common practice is to define a fixed constant in each calling program, then check for the existence of the constant in the library/include file; if the constant does not exist, then the file was directly requested, and it can exit immediately. This significantly reduces the chance of an attacker being able to bypass any protection mechanisms that are in the base program but not in the include files. It will also reduce the attack surface. |
| Implementation | Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not. In the context of path traversal, error messages which disclose path information can help attackers craft the appropriate attack strings to move through the file system hierarchy. |
| Operation, Implementation | When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues. |
CWE-23
Relative Path Traversal
Status: Draft
Description
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
Diagram
Alternate Terms
| Term | Description |
|---|---|
| Zip Slip | "Zip slip" is an attack that uses file archives (e.g., ZIP, tar, rar, etc.) that contain filenames with path traversal sequences that cause the files to be written outside of the directory under which the archive is expected to be extracted [REF-1282]. It is most commonly used for relative path traversal (CWE-23) and link following (CWE-59). |
Applicable Platforms
| Type | Name | Prevalence |
|---|---|---|
| Language | Not Language-Specific | Undetermined |
| Technology | Not Technology-Specific | Undetermined |
| Technology | Web Based | Often |
| Technology | AI/ML | Often |
Common Consequences
| Scope | Impact | Note |
|---|---|---|
| Integrity, Confidentiality, Availability | Execute Unauthorized Code or Commands | The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries. |
| Integrity | Modify Files or Directories | The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication. |
| Confidentiality | Read Files or Directories | The attacker may be able read the contents of unexpected files and expose sensitive data by traversing the file system to access files or directories that are outside of the restricted directory. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system. |
| Availability | DoS: Crash, Exit, or Restart | The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of a protection mechanisms such as authentication, it has the potential to lockout every user of the product. |
Potential Mitigations
| Phase | Description |
|---|---|
| Implementation | Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright. When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434. Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string. |
| Implementation | Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked. Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23, CWE-59). This includes: - realpath() in C - getCanonicalPath() in Java - GetFullPath() in ASP.NET - realpath() or abs_path() in Perl - realpath() in PHP |
| Operation | Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481]. |
Abstraction: Base
| Referenced By CVEs: |
| CVE-2026-76519 |
CWE-284
Improper Access Control
Status: Incomplete
Description
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Alternate Terms
| Term | Description |
|---|---|
| Authorization | The terms "access control" and "authorization" are often used interchangeably, although many people have distinct definitions. The CWE usage of "access control" is intended as a general term for the various mechanisms that restrict which users can access which resources, and "authorization" is more narrowly defined. It is unlikely that there will be community consensus on the use of these terms. |
Applicable Platforms
| Type | Name | Prevalence |
|---|---|---|
| Language | Not Language-Specific | Often |
| Technology | Not Technology-Specific | Often |
| Technology | ICS/OT | Often |
| Technology | Web Based | Often |
Common Consequences
| Scope | Impact | Note |
|---|---|---|
| Other | Varies by Context |
Potential Mitigations
| Phase | Description |
|---|---|
| Architecture and Design, Operation | Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software. |
| Architecture and Design | Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges. |
Abstraction: Pillar
| Referenced By CVEs: |
| CVE-2015-3306 |
CWE-287
Improper Authentication
Status: Draft
Description
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Diagram
Alternate Terms
| Term | Description |
|---|---|
| authentification | An alternate term is "authentification", which appears to be most commonly used by people from non-English-speaking countries. |
| AuthN | "AuthN" is typically used as an abbreviation of "authentication" within the web application security community. It is also distinct from "AuthZ," which is an abbreviation of "authorization." The use of "Auth" as an abbreviation is discouraged, since it could be used for either authentication or authorization. |
| AuthC | "AuthC" is used as an abbreviation of "authentication," but it appears to used less frequently than "AuthN." |
Applicable Platforms
| Type | Name | Prevalence |
|---|---|---|
| Language | Not Language-Specific | Undetermined |
| Operating_System | Not OS-Specific | Undetermined |
| Technology | Not Technology-Specific | Undetermined |
| Technology | Web Based | Undetermined |
| Technology | ICS/OT | Often |
Common Consequences
| Scope | Impact | Note |
|---|---|---|
| Integrity, Confidentiality, Availability, Access Control | Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands | This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code. |
Potential Mitigations
| Phase | Description |
|---|---|
| Architecture and Design | Use an authentication framework or library such as the OWASP ESAPI Authentication feature. |
CWE-290
Authentication Bypass by Spoofing
Status: Incomplete
Description
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Applicable Platforms
| Type | Name | Prevalence |
|---|---|---|
| Language | Not Language-Specific | Undetermined |
Common Consequences
| Scope | Impact | Note |
|---|---|---|
| Access Control | Bypass Protection Mechanism, Gain Privileges or Assume Identity | This weakness can allow an attacker to access resources which are not otherwise accessible without proper authentication. |
Abstraction: Base
| Referenced By CVEs: |
| CVE-2026-104935 |
CWE-312
Cleartext Storage of Sensitive Information
Status: Draft
Description
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Diagram
Applicable Platforms
| Type | Name | Prevalence |
|---|---|---|
| Language | Not Language-Specific | Undetermined |
| Technology | Cloud Computing | Undetermined |
| Technology | ICS/OT | Undetermined |
| Technology | Mobile | Undetermined |
Common Consequences
| Scope | Impact | Note |
|---|---|---|
| Confidentiality | Read Application Data | An attacker with access to the system could read sensitive information stored in cleartext (i.e., unencrypted). Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information. |
Potential Mitigations
| Phase | Description |
|---|---|
| Implementation, System Configuration, Operation | When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301] |
| Implementation, System Configuration, Operation | In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment. |
Abstraction: Base
| Referenced By CVEs: |
| CVE-2023-22894 |
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Status: Draft
Description
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Diagram
Alternate Terms
| Term | Description |
|---|---|
| Command injection | an attack-oriented phrase for this weakness. Note: often used when "OS command injection" (CWE-78) was intended. |
Applicable Platforms
| Type | Name | Prevalence |
|---|---|---|
| Language | Not Language-Specific | Undetermined |
| Technology | AI/ML | Undetermined |
Common Consequences
| Scope | Impact | Note |
|---|---|---|
| Integrity, Confidentiality, Availability | Execute Unauthorized Code or Commands | If a malicious user injects a character (such as a semi-colon) that delimits the end of one command and the beginning of another, it may be possible to then insert an entirely new and unrelated command that was not intended to be executed. This gives an attacker a privilege or capability that they would not otherwise have. |
Potential Mitigations
| Phase | Description |
|---|---|
| Architecture and Design | If at all possible, use library calls rather than external processes to recreate the desired functionality. |
| Implementation | If possible, ensure that all external commands called from the program are statically created. |
| Implementation | Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright. |
| Operation | Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands. |
| System Configuration | Assign permissions that prevent the user from accessing/opening privileged files. |
Exploit Likelihood
High
Abstraction: Class
| Referenced By CVEs: |
| CVE-2016-3081 CVE-2026-105134 CVE-2026-96951 |
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Status: Stable
Description
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Diagram
Alternate Terms
| Term | Description |
|---|---|
| Shell injection | |
| Shell metacharacters | |
| OS Command Injection |
Applicable Platforms
| Type | Name | Prevalence |
|---|---|---|
| Language | Not Language-Specific | Undetermined |
| Technology | Not Technology-Specific | Undetermined |
| Technology | AI/ML | Often |
| Technology | Web Server | Often |
Common Consequences
| Scope | Impact | Note |
|---|---|---|
| Confidentiality, Integrity, Availability, Non-Repudiation | Execute Unauthorized Code or Commands, DoS: Crash, Exit, or Restart, Read Files or Directories, Modify Files or Directories, Read Application Data, Modify Application Data, Hide Activities | Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner. |
Potential Mitigations
| Phase | Description |
|---|---|
| Architecture and Design | If at all possible, use library calls rather than external processes to recreate the desired functionality. |
| Architecture and Design, Operation | Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails. |
| Architecture and Design | For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field. |
| Architecture and Design | For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server. |
| Architecture and Design | Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error. |
| Implementation | While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or white space). If some special characters are still needed, such as white space, wrap each argument in quotes after the escaping/filtering step. Be careful of argument injection (CWE-88). |
| Implementation | If the program to be executed allows arguments to be specified within an input file or from standard input, then consider using that mode to pass arguments instead of the command line. |
| Architecture and Design | If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated. Some languages offer multiple functions that can be used to invoke commands. Where possible, identify any function that invokes a command shell using a single string, and replace it with a function that requires individual arguments. These functions typically perform appropriate quoting and filtering of arguments. For example, in C, the system() function accepts a string that contains the entire command to be executed, whereas execl(), execve(), and others require an array of strings, one for each argument. In Windows, CreateProcess() only accepts one command at a time. In Perl, if system() is provided with an array of arguments, then it will quote each of the arguments. |
| Implementation | Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright. When constructing OS command strings, use stringent allowlists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack, but this technique is less important than proper output encoding and escaping. Note that proper output encoding, escaping, and quoting is the most effective solution for preventing OS command injection, although input validation may provide some defense-in-depth. This is because it effectively limits what will appear in output. Input validation will not always prevent OS command injection, especially if you are required to support free-form text fields that could contain arbitrary characters. For example, when invoking a mail program, you might need to allow the subject field to contain otherwise-dangerous inputs like ";" and ">" characters, which would need to be escaped or otherwise handled. In this case, stripping the character might reduce the risk of OS command injection, but it would produce incorrect behavior because the subject field would not be recorded as the user intended. This might seem to be a minor inconvenience, but it could be more important when the program relies on well-structured subject lines in order to pass messages to other components. Even if you make a mistake in your validation (such as forgetting one out of 100 input fields), appropriate encoding is still likely to protect you from injection-based attacks. As long as it is not done in isolation, input validation is still a useful technique, since it may significantly reduce your attack surface, allow you to detect some attacks, and provide other security benefits that proper encoding does not address. |
| Architecture and Design | When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. |
| Operation | Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184). |
| Operation | Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184). |
| Implementation | Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not. In the context of OS Command Injection, error information passed back to the user might reveal whether an OS command is being executed and possibly which command is being used. |
| Operation | Use runtime policy enforcement to create an allowlist of allowable commands, then prevent use of any command that does not appear in the allowlist. Technologies such as AppArmor are available to do this. |
| Operation | Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481]. |
| Architecture and Design, Operation | Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations. |
| Operation, Implementation | When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues. |
CWE-94
Improper Control of Generation of Code ('Code Injection')
Status: Draft
Description
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Diagram
Alternate Terms
| Term | Description |
|---|---|
| Code Injection |
Applicable Platforms
| Type | Name | Prevalence |
|---|---|---|
| Language | Interpreted | Sometimes |
| Technology | AI/ML | Undetermined |
Common Consequences
| Scope | Impact | Note |
|---|---|---|
| Access Control | Bypass Protection Mechanism | In some cases, injectable code controls authentication; this may lead to a remote vulnerability. |
| Access Control | Gain Privileges or Assume Identity | Injected code can access resources that the attacker is directly prevented from accessing. |
| Integrity, Confidentiality, Availability | Execute Unauthorized Code or Commands | When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. As a result, code injection can often result in the execution of arbitrary code. Code injection attacks can also lead to loss of data integrity in nearly all cases, since the control-plane data injected is always incidental to data recall or writing. |
| Non-Repudiation | Hide Activities | Often the actions performed by injected control code are unlogged. |
Potential Mitigations
| Phase | Description |
|---|---|
| Architecture and Design | Refactor your program so that you do not have to dynamically generate code. |
| Architecture and Design | Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails. |
| Implementation | Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright. To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit(). |
| Testing | Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results. |
| Operation | Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184). |
| Operation | Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184). |
| Implementation | For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373]. |
