Fallos del tipo CWE-78

4591 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2026-41925CRITICALWDR201A WiFi Extender OS Command Injection via adm.cgi (reboot_time)EPSS 3.4%CVE-2024-7066MEDIUMF-logic DataCube3 HTTP POST Request config_time_sync.php os command injectionEPSS 3.4%CVE-2020-2000HIGHPAN-OS: OS command injection and memory corruption vulnerabilityEPSS 3.4%CVE-2026-46339CRITICAL9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routesEPSS 3.4%CVE-2023-31128HIGHNextCloud Cookbook's pull-checks.yml workflow is vulnerable to OS Command InjectionEPSS 3.3%CVE-2022-38649CRITICALApache Airflow Pinot provider allowed Command InjectionEPSS 3.3%CVE-2025-70329HIGHTOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd eEPSS 3.3%CVE-2022-33195CRITICALFour OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9EPSS 3.3%CVE-2022-33192CRITICALFour OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9EPSS 3.3%CVE-2022-33189CRITICALAn OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A EPSS 3.3%CVE-2022-32773CRITICALAn OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and EPSS 3.3%CVE-2024-9001MEDIUMTOTOLINK T10 cstecgi.cgi setTracerouteCfg os command injectionEPSS 3.3%CVE-2025-34115HIGHOP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.phpEPSS 3.3%CVE-2026-28409CRITICALWeGIA Vulnerable to Remote Code Execution (RCE) via OS Command InjectionEPSS 3.3%CVE-2023-4464HIGHPoly VVX 601 Diagnostic Telnet Mode os command injectionEPSS 3.3%CVE-2026-25244CRITICALWebdriverIO has Command Injection in the BrowserStack ServiceEPSS 3.3%CVE-2021-3198MEDIUMIvanti MobileIron Core clish Restricted Shell Escape via OS Command InjectionEPSS 3.3%CVE-2020-13378HIGHLoadbalancer.org Enterprise VA MAX through 8.3.8 has an OS Command Injection vulnerability that allows a remote authenticated attacker to exEPSS 3.3%CVE-2019-15979HIGHCisco Data Center Network Manager Command Injection VulnerabilitiesEPSS 3.3%CVE-2022-31138HIGHOS Command Injection in mailcowEPSS 3.3%