SV.EXEC

This error is detected when user input is used, unchecked, for all or part of an operating system command executed by the application.

Vulnerability and risk

In general, process creation or execution of external commands within an application is a security concern. There is a serious vulnerability if user input is used in any part of the command string used for execution. Attackers can inject additional commands and have them executed on the application server, leading to a process or command injection condition. The ability to run arbitrary commands can lead to denial-of-service (DoS), data corruption, data security violations and other risks.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Prevent process or command injection attacks from user input by validating any and all input from outside the application (user input, file input, system parameters, etc.). Validation should include length and content. Ideally you should avoid using user data in process creation commands. Any other accepted characters should be escaped. Perform validation at each source of data, such as when each parameter is read from the HTTP request, or user interface such as an application or the console.

Example 1

Copy 
     public void checkHost(ServletRequest req) throws IOException {
         // Source of data from HTTP request in servlet
         String hostName = req.getParameter("userHostName");
         String command = "nslookup " + hostName;
         Process proc = Runtime.getRuntime().exec(command);
         // ...
     }

SV.EXEC is reported for line 15: 'hostName' contains data coming from an HTTP request parameter and might be tainted (line 13). This value is concatenated with a constant string and stored in 'command' on line 14. The 'command' is executed as a shell command on line 15, thus the host system is vulnerable to dangerous commands executed by attackers.

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.