CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

This weakness occurs when untrusted data is incorporated into a command string that the application executes or passes to another command interpreter. An injected delimiter or other command-language syntax can terminate the intended command and introduce a new command or operation. The issue is not limited to operating system shells: custom languages used by protocols, utilities, image processors, configuration formats, and other products can also interpret attacker-controlled syntax. It is distinct from the broader command-language injection category and is often, though not always, associated with OS command injection.

The weakness is language and platform agnostic and can arise during implementation when data from an untrusted source becomes part of a command executed by the application. It commonly involves a source-to-sink data flow in which externally influenced input reaches a command interpreter or another component that parses command syntax. The relevant syntax may be shell metacharacters, script syntax, optional arguments, configuration commands, or constructs from a product-specific command language. The official record lists AI/ML as an applicable technology, but does not establish prevalence.

A successful injection can allow an attacker to execute unauthorized code or commands, giving the attacker capabilities or privileges that were not intended. The resulting impact can affect confidentiality, integrity, and availability, depending on the commands accepted by the downstream component and the privileges of the executing process.

Architecture and design: Prefer library calls over external processes when they can provide the required functionality. Implementation: Keep externally invoked commands statically defined whenever possible. Treat all input as malicious and apply strict allowlist, or accept-known-good, validation covering length, type, allowed values, missing or extra fields, syntax, consistency, and business rules. Do not rely only on denylists or searches for known malicious patterns; denylists can still help detect suspected attacks or reject clearly malformed input. Runtime and configuration: Enforce an allowlist of sanctioned commands at runtime and assign permissions that prevent users from accessing or opening privileged files.

Automated static analysis, commonly called Static Application Security Testing (SAST), can identify some instances without executing the program. It typically models data flow and control flow, then searches for paths from input sources to sinks where data interacts with external components or lower layers such as the operating system. This approach has high stated effectiveness, but its coverage is limited to weaknesses that can be recognized from the analyzed code or compiled representation and modeled source-to-sink patterns.

The official record provides these representative examples, not an exhaustive list:

• CVE-2022-1509, CVE-2021-41282, and CVE-2019-13398: injection of sed script syntax.
• CVE-2024-5184: direct prompt injection in an API service using a large generative AI model, allowing leakage of hard-coded system prompts or execution of other prompts.
• CVE-2020-11698: injection of SNMP commands into a configuration file in an anti-spam product.
• CVE-2019-12921: command injection in the Magick Vector Graphics (MVG) language used by an image program.
• CVE-2022-36069: injection of optional arguments beginning with a dash in a Python dependency management tool, potentially enabling code execution, despite avoidance of OS command injection when generating Git commands.
• CVE-1999-0067: failure to neutralize the | metacharacter when a CGI program invoked a phonebook program.
• CVE-2020-9054: improper validation of a username parameter leading to OS command injection, with exploitation in the wild noted in the record.