SV.EXEC.DIR

This error is detected when user input is used, unchecked, for all or part of a working directory used to select a command executed by the application.

Vulnerability and risk

In general, process creation or execution of external commands within an application is a security concern. This particular vulnerability occurs when all or part of the working directory used for the command or process is derived from unvalidated user input. An attacker can manipulate the working directory and cause undesired behavior, possibly running commands planted by the attacker rather than the intended command.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Prevent process or command injection attacks from user input by validating any and all input from outside the application (user input, file input, system parameters, etc.). Validation should include length and content. Typically only alphanumeric characters are needed (i.e., A-Za-z, 0-9). Any other accepted characters should be escaped. Perform validation at each source of data, such as when each parameter is read from the HTTP request, or user interface such as an application or the console.

Example 1

15
16
17
18
19
20
21
     public void dataQuery(ServletRequest req) throws IOException {
         String var = req.getParameter("username");
         File userRoot = new File(webRoot, var);
         Process proc = Runtime.getRuntime().exec("processRequest", null, userRoot);
         // parse results of command
         // ...
     }

SV.EXEC.DIR is reported for line 18: 'var' contains data coming from an HTTP request parameter and might be tainted (line 13). This value is used to create an object of type 'java.io.File' on line 17, which is later used as the working directory for the process being executed on line 18.

External guidance

• CERT IDS07-J: Sanitize untrusted data passed to the Runtime.exec() method
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• OWASP A1:2017 Injection
• OWASP A3:2021 Injection
• STIG-ID: APP3570 Application vulnerable to Command Injection

Security training

Application security training materials provided by Secure Code Warrior.

• Os Command Injections Training Video - Test your skills with a training example

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.