In general, process creation or execution of external commands within an application is a security concern. There is a serious vulnerability if user input is used in any part of the command string used for execution. Attackers can change environment variables, leading to denial-of-service (DoS), data corruption, data security violations and other risks.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Prevent process or command injection attacks from user input by validating any and all input from outside the application (user input, file input, system parameters, etc.). Validation should include length and content. Typically only alphanumeric characters are needed (i.e., A-Za-z, 0-9). Any other accepted characters should be escaped. Perform validation at each source of data, such as when each parameter is read from the HTTP request, or user interface such as an application or the console.

Example 1

11     public void dataQuery(ServletRequest req) throws IOException {
12         String var = "USER_HOME=" + req.getParameter("username");
13         String[] env = new String[]{var};
14         Process proc = Runtime.getRuntime().exec("processRequest", env);
15         // parse results of command
16         // ...
17     }

SV.EXEC.ENV is reported for line 14: 'var' contains data coming from an HTTP request parameter and might be tainted (line 12). This value is stored in string array 'env' on line 13 which is used as a parameter for process execution on line 14. An attacker may change environment variables to modify application behavior.

Security guidelines

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.