Falhas do tipo CWE-77

2.808 resultados

Injeção de comando

O software monta comandos do sistema ou de interpretadores (shell, SQL, etc.) usando dados que vêm de fora (entrada do usuário, requisição HTTP, arquivo) sem sanitizar ou sanitizando incorretamente caracteres especiais. Um atacante consegue 'fechar' o comando legítimo e injetar comandos arbitrários que serão executados com os mesmos privilégios da aplicação.

Exemplo

Um script que executa `ping` no endereço fornecido pelo usuário: `system('ping ' + user_input)`. Se o usuário digita `8.8.8.8; rm -rf /`, o comando executado vira dois: primeiro o ping, depois a deleção de arquivos. A maioria das CVEs de injeção de comando vêm deste padrão.

Como mitigar

Use APIs que aceitam argumentos como lista (não concatenação de strings) — ex: subprocess.run(['ping', user_input]) em Python ou parameterized queries em banco de dados. Se precisar de interpretador, valide rigorosamente a entrada com lista branca (aceita apenas IP/domínio válido) e evite shells intermediários.

CVE-2024-55956CRITICALIn Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitEPSS 94.0%KEVCVE-2025-4008HIGHArbitrary Command Injection in Smartbedded MeteoBridgeEPSS 93.7%KEVCVE-2022-40022CRITICALMicrochip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.EPSS 92.5%CVE-2019-5420—A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically geneEPSS 92.1%CVE-2024-11320MEDIUMCommand Injection leading to RCE via LDAP MisconfigurationEPSS 91.0%CVE-2023-47218MEDIUMQTS, QuTS hero, QuTScloudEPSS 89.9%CVE-2025-29635HIGHA command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remoteEPSS 87.9%KEVCVE-2024-12356CRITICALCommand Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)EPSS 87.9%KEVCVE-2026-42271HIGHLiteLLM: Authenticated command execution via MCP stdio test endpointsEPSS 83.6%KEVCVE-2022-42904HIGHZoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.EPSS 83.1%CVE-2022-40770HIGHZoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by highEPSS 81.3%CVE-2018-12465CRITICALRemote Code Execution in Micro Focus Secure Messaging GatewayEPSS 80.0%CVE-2023-20889HIGHAria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria OperatioEPSS 79.3%CVE-2021-42129—A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform EPSS 77.3%CVE-2022-41800HIGHAppliance mode iControl REST vulnerabilityEPSS 76.9%CVE-2023-32007HIGHApache Spark: Shell command injection via Spark UIEPSS 76.0%CVE-2005-2773CRITICALHP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) EPSS 74.6%KEVCVE-2017-15889—Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to exEPSS 73.7%CVE-2021-4045CRITICALTP-LINK Tapo C200 remote code execution vulnerabilityEPSS 72.4%CVE-2025-4009CRITICALUnauthenticated Arbitrary Command Injection in Evertz SDVNEPSS 71.4%