Fallos del tipo CWE-78

4575 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2026-8192MEDIUMWavlink NU516U1 adm.cgi wzdap os command injectionEPSS 6.5%CVE-2019-25065MEDIUMOpenNetAdmin os command injectionEPSS 6.5%CVE-2013-10060CRITICALNetgear Routers pppoe.cgi RCEEPSS 6.5%CVE-2026-8189MEDIUMWavlink NU516U1 adm.cgi wzdrepeater os command injectionEPSS 6.5%CVE-2024-33112HIGHD-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap_main()func.EPSS 6.5%CVE-2024-28892CRITICALAn OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary cEPSS 6.5%CVE-2017-14001—An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior. An OS commEPSS 6.4%CVE-2023-6319CRITICALCommand injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager serviceEPSS 6.4%CVE-2024-4815MEDIUMRuijie RG-UAC detail.php os command injectionEPSS 6.4%CVE-2024-4813MEDIUMRuijie RG-UAC interface_commit.php os command injectionEPSS 6.4%CVE-2023-53941CRITICALEasyPHP Webserver 14.1 Remote Code ExecutionEPSS 6.4%CVE-2024-4814MEDIUMRuijie RG-UAC static_route_edit_commit.php os command injectionEPSS 6.4%CVE-2024-4816MEDIUMRuijie RG-UAC gre_add_commit.php os command injectionEPSS 6.4%CVE-2023-3607MEDIUMkodbox WebConsole Plug-In webconsole.php.txt Execute os command injectionEPSS 6.4%CVE-2026-44194CRITICALOPNsense: RCE on user managmentEPSS 6.4%CVE-2025-43979HIGHAn issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN that allows authenticated attackers to execute arbitrary OS system coEPSS 6.3%CVE-2025-34095CRITICALMako Server v2.5 and v2.6 OS Command Injection via examples/save.lspEPSS 6.3%CVE-2024-29224CRITICALAn OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary coEPSS 6.3%CVE-2013-10061HIGHNetgear Routers setup.cgi RCEEPSS 6.3%CVE-2026-2944MEDIUMTosei Online Store Management System ネット店舗管理システム HTTP POST Request monitor.php system os command injectionEPSS 6.2%