Fallos del tipo CWE-78

5063 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2024-41317HIGHTOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_eEPSS 2.3%CVE-2021-36023CRITICALMagento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code ExecutionEPSS 2.3%CVE-2021-23025—On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated rEPSS 2.3%CVE-2026-54795HIGHDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS CommEPSS 2.3%CVE-2026-78541HIGHCommand Injection in Parent Control of TP-Link Archer BE3600 v1EPSS 2.3%CVE-2022-46649HIGHAcemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary sheEPSS 2.3%CVE-2026-38822HIGHIn openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulneEPSS 2.3%CVE-2026-18264HIGHNoMachine getstat Command Injection Remote Code Execution VulnerabilityEPSS 2.3%CVE-2026-71929HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via setDevProtoEPSS 2.3%CVE-2026-71910HIGHDrayTek VigorAP Multiple Models OS Command Injection via apautotestEPSS 2.3%CVE-2026-71943HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via setDevNetEPSS 2.3%CVE-2026-71908HIGHDrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_testEPSS 2.3%CVE-2026-71925HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via getDetailEPSS 2.3%CVE-2026-71927HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via rebDeviceEPSS 2.3%CVE-2026-71905HIGHDrayTek VigorAP Multiple Models OS Command Injection via ExportSettingsEPSS 2.3%CVE-2026-71918HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via webBackupActionEPSS 2.3%CVE-2026-71926HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via setDeviceEPSS 2.3%CVE-2026-71909HIGHDrayTek VigorAP Multiple Models OS Command Injection via InquierTimeEPSS 2.3%CVE-2026-71915HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatusEPSS 2.3%CVE-2026-71906HIGHDrayTek VigorAP Multiple Models OS Command Injection via setLanEPSS 2.3%