CWE-77
Allowed-with-ReviewImproper Neutralization of Special Elements used in a Command ('Command Injection')
Abstraction: Class · Status: Draft
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
5386 vulnerabilities reference this CWE, most recent first.
GHSA-6M6H-8F8V-R7J4
Vulnerability from github – Published: 2026-04-15 18:31 – Updated: 2026-04-15 18:31A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
{
"affected": [],
"aliases": [
"CVE-2026-20147"
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-15T17:17:02Z",
"severity": "CRITICAL"
},
"details": "A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.\n\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.",
"id": "GHSA-6m6h-8f8v-r7j4",
"modified": "2026-04-15T18:31:58Z",
"published": "2026-04-15T18:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20147"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6M6P-WP2F-XJQC
Vulnerability from github – Published: 2025-07-29 18:30 – Updated: 2025-09-15 15:31Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184C0 function via the tz parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.
{
"affected": [],
"aliases": [
"CVE-2025-52284"
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-29T18:15:30Z",
"severity": "MODERATE"
},
"details": "Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184C0 function via the tz parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.",
"id": "GHSA-6m6p-wp2f-xjqc",
"modified": "2025-09-15T15:31:10Z",
"published": "2025-07-29T18:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52284"
},
{
"type": "WEB",
"url": "https://github.com/w0rkd4tt/Totolink"
},
{
"type": "WEB",
"url": "https://www.notion.so/setNtpCfg-20e8aff2dc8b80a3afafef36b48f7496"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6M7M-CXF3-4PHV
Vulnerability from github – Published: 2026-03-26 06:30 – Updated: 2026-03-26 06:30A security flaw has been discovered in Netcore Power 15AX up to 3.0.0.6938. Affected by this issue is the function setTools of the file /bin/netis.cgi of the component Diagnostic Tool Interface. Performing a manipulation of the argument IpAddr results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-4840"
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-26T05:16:40Z",
"severity": "HIGH"
},
"details": "A security flaw has been discovered in Netcore Power 15AX up to 3.0.0.6938. Affected by this issue is the function setTools of the file /bin/netis.cgi of the component Diagnostic Tool Interface. Performing a manipulation of the argument IpAddr results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-6m7m-cxf3-4phv",
"modified": "2026-03-26T06:30:21Z",
"published": "2026-03-26T06:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4840"
},
{
"type": "WEB",
"url": "https://github.com/fakervsbln/netcore-power15ax-cve"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.353146"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.353146"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.776127"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6MH8-832J-GC49
Vulnerability from github – Published: 2025-01-19 15:30 – Updated: 2025-01-19 15:30IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow a privileged user to inject commands into the underlying operating system due to improper validation of a specified type of input.
{
"affected": [],
"aliases": [
"CVE-2024-41783"
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-19T15:15:21Z",
"severity": "CRITICAL"
},
"details": "IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow a privileged user to inject commands into the underlying operating system due to improper validation of a specified type of input.",
"id": "GHSA-6mh8-832j-gc49",
"modified": "2025-01-19T15:30:46Z",
"published": "2025-01-19T15:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41783"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7176189"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6MJ7-M8R8-G28V
Vulnerability from github – Published: 2024-03-31 03:30 – Updated: 2024-03-31 03:30A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network.
{
"affected": [],
"aliases": [
"CVE-2023-41724"
],
"database_specific": {
"cwe_ids": [
"CWE-77",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-31T02:15:07Z",
"severity": "CRITICAL"
},
"details": "A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network. ",
"id": "GHSA-6mj7-m8r8-g28v",
"modified": "2024-03-31T03:30:27Z",
"published": "2024-03-31T03:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41724"
},
{
"type": "WEB",
"url": "https://forums.ivanti.com/s/article/CVE-2023-41724-Remote-Code-Execution-for-Ivanti-Standalone-Sentry"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6MMM-JMJG-QXJF
Vulnerability from github – Published: 2025-05-25 03:30 – Updated: 2025-05-25 03:30A vulnerability was found in Qualitor 8.20. It has been rated as critical. Affected by this issue is some unknown functionality of the file /html/ad/adconexaooffice365/request/testaConexaoOffice365.php. The manipulation of the argument nmconexao leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-5139"
],
"database_specific": {
"cwe_ids": [
"CWE-74",
"CWE-77"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-25T01:15:23Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Qualitor 8.20. It has been rated as critical. Affected by this issue is some unknown functionality of the file /html/ad/adconexaooffice365/request/testaConexaoOffice365.php. The manipulation of the argument nmconexao leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-6mmm-jmjg-qxjf",
"modified": "2025-05-25T03:30:30Z",
"published": "2025-05-25T03:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5139"
},
{
"type": "WEB",
"url": "https://gist.githubusercontent.com/MatheuZSecurity/fe221fd5b2e5393abf76be42f11f52c3/raw/e8d9c63885f0b83b3374db3d31dbe2c69c868334/poc.sh"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310220"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310220"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.572477"
},
{
"type": "WEB",
"url": "https://www.youtube.com/watch?v=Dq4C5s9Uwyo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6MPJ-7W8C-WV4J
Vulnerability from github – Published: 2022-05-24 17:37 – Updated: 2022-05-24 17:37Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.58, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.5.2, and R9000 before 1.0.5.2.
{
"affected": [],
"aliases": [
"CVE-2020-35793"
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-30T00:15:00Z",
"severity": "MODERATE"
},
"details": "Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.58, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.5.2, and R9000 before 1.0.5.2.",
"id": "GHSA-6mpj-7w8c-wv4j",
"modified": "2022-05-24T17:37:42Z",
"published": "2022-05-24T17:37:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35793"
},
{
"type": "WEB",
"url": "https://kb.netgear.com/000062725/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2019-0185"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6MVH-MQ55-P77G
Vulnerability from github – Published: 2026-04-27 18:32 – Updated: 2026-04-27 18:32A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wanIdx can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
{
"affected": [],
"aliases": [
"CVE-2026-7136"
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-27T16:16:46Z",
"severity": "HIGH"
},
"details": "A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wanIdx can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.",
"id": "GHSA-6mvh-mq55-p77g",
"modified": "2026-04-27T18:32:08Z",
"published": "2026-04-27T18:32:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7136"
},
{
"type": "WEB",
"url": "https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_311/README.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/801007"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/359735"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/359735/cti"
},
{
"type": "WEB",
"url": "https://www.totolink.net"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6MX5-J85J-5862
Vulnerability from github – Published: 2022-12-16 21:30 – Updated: 2022-12-29 15:30The default console presented to users over telnet (when enabled) is restricted to a subset of commands. Commands issued at this console, however, appear to be fed directly into a system call or other similar function. This allows any authenticated user to execute arbitrary commands on the device.
{
"affected": [],
"aliases": [
"CVE-2022-47210"
],
"database_specific": {
"cwe_ids": [
"CWE-77",
"CWE-78"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-16T20:15:00Z",
"severity": "HIGH"
},
"details": "The default console presented to users over telnet (when enabled) is restricted to a subset of commands. Commands issued at this console, however, appear to be fed directly into a system call or other similar function. This allows any authenticated user to execute arbitrary commands on the device.",
"id": "GHSA-6mx5-j85j-5862",
"modified": "2022-12-29T15:30:28Z",
"published": "2022-12-16T21:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47210"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2022-37"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6P2J-742G-835F
Vulnerability from github – Published: 2026-04-04 06:03 – Updated: 2026-04-04 06:03Summary
External input from github.event.issue.title is used unsafely in a shell command in .github/workflows/release-candidate.yaml, allowing command injection during workflow execution.
Details
In .github/workflows/release-candidate.yaml, the issue title is interpolated directly into a shell command:
export VERSION=$(echo ${{ github.event.issue.title }} | sed -E 's/Release v?([0-9\.]*)/\1/g')
Because the issue title is attacker-controlled and is embedded directly into a shell command, shell metacharacters such as command substitution ($()) and command separators (;) can be interpreted by the shell.
Although the workflow checks that the title starts with Release, this condition can still be satisfied by a maliciously crafted input.
PoC
- Create or edit an issue with the following title:
Release v1.2.3 $(whoami)
-
Trigger the workflow that processes the issue.
-
Observe that the injected command is executed on the runner.
The workflow logs show that $(whoami) is evaluated and its output (runner) appears in the command result, confirming that attacker-controlled input is executed within the shell.
Impact
This vulnerability allows command injection in the GitHub Actions runner through attacker-controlled issue titles. An attacker may be able to execute arbitrary commands within the context of the affected workflow job.
Depending on the workflow configuration (such as permissions and available secrets), successful exploitation could lead to:
- Unauthorized command execution in the CI environment
- Misuse of the
GITHUB_TOKEN - Modification of repository state, release artifacts, or other workflow outputs
If the repository is public and allows untrusted users to create or reopen issues that trigger the workflow, this may be exploitable by external users.
This issue is limited to the repository's internal workflow configuration and does not directly affect downstream users of the published actions-mkdocs GitHub Action.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.24.0"
},
"package": {
"ecosystem": "GitHub Actions",
"name": "Tiryoh/actions-mkdocs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.25.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-04T06:03:06Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nExternal input from `github.event.issue.title` is used unsafely in a shell command in `.github/workflows/release-candidate.yaml`, allowing command injection during workflow execution.\n\n### Details\n\nIn `.github/workflows/release-candidate.yaml`, the issue title is interpolated directly into a shell command:\n\n```\nexport VERSION=$(echo ${{ github.event.issue.title }} | sed -E \u0027s/Release v?([0-9\\.]*)/\\1/g\u0027)\n```\n\nBecause the issue title is attacker-controlled and is embedded directly into a shell command, shell metacharacters such as command substitution (`$()`) and command separators (`;`) can be interpreted by the shell.\n\nAlthough the workflow checks that the title starts with `Release `, this condition can still be satisfied by a maliciously crafted input.\n\n### PoC\n\n1. Create or edit an issue with the following title:\n\n ```\n Release v1.2.3 $(whoami)\n ```\n\n2. Trigger the workflow that processes the issue.\n\n3. Observe that the injected command is executed on the runner.\n\nThe workflow logs show that `$(whoami)` is evaluated and its output (`runner`) appears in the command result, confirming that attacker-controlled input is executed within the shell.\n\n\u003cimg width=\"633\" height=\"380\" alt=\"\u1109\u1173\u110f\u1173\u1105\u1175\u11ab\u1109\u1163\u11ba 2026-03-27 \u110b\u1169\u1112\u116e 8 33 43\" src=\"https://github.com/user-attachments/assets/90b38dab-8c53-4a13-8302-158ac5acf051\" /\u003e\n\n\n### Impact\n\nThis vulnerability allows command injection in the GitHub Actions runner through attacker-controlled issue titles. An attacker may be able to execute arbitrary commands within the context of the affected workflow job.\n\nDepending on the workflow configuration (such as permissions and available secrets), successful exploitation could lead to:\n\n* Unauthorized command execution in the CI environment\n* Misuse of the `GITHUB_TOKEN`\n* Modification of repository state, release artifacts, or other workflow outputs\n\nIf the repository is public and allows untrusted users to create or reopen issues that trigger the workflow, this may be exploitable by external users.\n\nThis issue is limited to the repository\u0027s internal workflow configuration and does not directly affect downstream users of the published `actions-mkdocs` GitHub Action.",
"id": "GHSA-6p2j-742g-835f",
"modified": "2026-04-04T06:03:06Z",
"published": "2026-04-04T06:03:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Tiryoh/actions-mkdocs/security/advisories/GHSA-6p2j-742g-835f"
},
{
"type": "PACKAGE",
"url": "https://github.com/Tiryoh/actions-mkdocs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "actions-mkdocs: Command Injection via issue title in internal GitHub Actions workflow"
}
Mitigation
If at all possible, use library calls rather than external processes to recreate the desired functionality.
Mitigation
If possible, ensure that all external commands called from the program are statically created.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation
Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
Mitigation
Assign permissions that prevent the user from accessing/opening privileged files.
CAPEC-136: LDAP Injection
An attacker manipulates or crafts an LDAP query for the purpose of undermining the security of the target. Some applications use user input to create LDAP queries that are processed by an LDAP server. For example, a user might provide their username during authentication and the username might be inserted in an LDAP query during the authentication process. An attacker could use this input to inject additional commands into an LDAP query that could disclose sensitive information. For example, entering a * in the aforementioned query might return information about all users on the system. This attack is very similar to an SQL injection attack in that it manipulates a query to gather additional information or coerce a particular return value.
CAPEC-15: Command Delimiters
An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
CAPEC-183: IMAP/SMTP Command Injection
An adversary exploits weaknesses in input validation on web-mail servers to execute commands on the IMAP/SMTP server. Web-mail servers often sit between the Internet and the IMAP or SMTP mail server. User requests are received by the web-mail servers which then query the back-end mail server for the requested information and return this response to the user. In an IMAP/SMTP command injection attack, mail-server commands are embedded in parts of the request sent to the web-mail server. If the web-mail server fails to adequately sanitize these requests, these commands are then sent to the back-end mail server when it is queried by the web-mail server, where the commands are then executed. This attack can be especially dangerous since administrators may assume that the back-end server is protected against direct Internet access and therefore may not secure it adequately against the execution of malicious commands.
CAPEC-248: Command Injection
An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.
CAPEC-40: Manipulating Writeable Terminal Devices
This attack exploits terminal devices that allow themselves to be written to by other users. The attacker sends command strings to the target terminal device hoping that the target user will hit enter and thereby execute the malicious command with their privileges. The attacker can send the results (such as copying /etc/passwd) to a known directory and collect once the attack has succeeded.
CAPEC-43: Exploiting Multiple Input Interpretation Layers
An attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a "layer" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal is to first discover cases where the input validation layer executes before one or more parsing layers. That is, user input may go through the following logic in an application: <parser1> --> <input validator> --> <parser2>. In such cases, the attacker will need to provide input that will pass through the input validator, but after passing through parser2, will be converted into something that the input validator was supposed to stop.
CAPEC-75: Manipulating Writeable Configuration Files
Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.