Falhas do tipo CWE-77

2.807 resultados

Injeção de comando

O software monta comandos do sistema ou de interpretadores (shell, SQL, etc.) usando dados que vêm de fora (entrada do usuário, requisição HTTP, arquivo) sem sanitizar ou sanitizando incorretamente caracteres especiais. Um atacante consegue 'fechar' o comando legítimo e injetar comandos arbitrários que serão executados com os mesmos privilégios da aplicação.

Exemplo

Um script que executa `ping` no endereço fornecido pelo usuário: `system('ping ' + user_input)`. Se o usuário digita `8.8.8.8; rm -rf /`, o comando executado vira dois: primeiro o ping, depois a deleção de arquivos. A maioria das CVEs de injeção de comando vêm deste padrão.

Como mitigar

Use APIs que aceitam argumentos como lista (não concatenação de strings) — ex: subprocess.run(['ping', user_input]) em Python ou parameterized queries em banco de dados. Se precisar de interpretador, valide rigorosamente a entrada com lista branca (aceita apenas IP/domínio válido) e evite shells intermediários.

CVE-2021-42132—A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform EPSS 70.1%CVE-2023-26801CRITICALLB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a comEPSS 69.7%CVE-2017-15889—Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to exEPSS 68.3%CVE-2024-3116HIGHRemote Code Execution Vulnerability through the validate binary path API in pgAdmin 4EPSS 65.6%CVE-2016-20017CRITICALD-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wilEPSS 65.2%KEVCVE-2024-4883CRITICALWhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution VulnerabilityEPSS 64.5%CVE-2024-9380HIGHAn OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker witEPSS 63.2%KEVCVE-2023-4120MEDIUMByzoro Smart S85F Management Platform importhtml.php command injectionEPSS 62.3%CVE-2024-12971HIGHQuickShell Authenticated Command InjectionEPSS 61.5%CVE-2023-31446CRITICALIn Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. TEPSS 61.1%CVE-2022-2143CRITICALAdvantech iViewEPSS 59.4%CVE-2025-4443MEDIUMD-Link DIR-605L sub_454F2C command injectionEPSS 57.6%CVE-2023-28425MEDIUMSpecially crafted MSETNX command can lead to denial-of-serviceEPSS 54.7%CVE-2025-9528MEDIUMLinksys E1700 systemCommand os command injectionEPSS 54.5%CVE-2019-16012MEDIUMCisco SD-WAN Solution vManage SQL Injection VulnerabilityEPSS 54.2%CVE-2023-20118MEDIUMA vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers EPSS 54.1%KEVCVE-2020-25079HIGHAn issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticaEPSS 54.0%KEVCVE-2019-0541HIGHA remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code ExEPSS 53.2%KEVCVE-2025-54782CRITICAL@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS DevelopersEPSS 51.3%CVE-2025-1338MEDIUMNUUO Camera handle_config.php print_file command injectionEPSS 51.1%