Code injection


Code injection is a computer security exploit where a program fails to correctly process external data, such as user input, causing it to interpret the data as executable commands. An attacker using this method "injects" code into the program while it is running. Successful exploitation of a code injection vulnerability can result in data breaches, access to restricted or critical computer systems, and the spread of malware.
Code injection vulnerabilities occur when an application sends untrusted data to an interpreter, which then executes the injected text as code. Injection flaws are often found in services like Structured Query Language databases, Extensible Markup Language parsers, operating system commands, Simple Mail Transfer Protocol headers, and other program arguments. Injection flaws can be identified through source code examination, Static analysis, or dynamic testing methods such as fuzzing.
There are numerous types of code injection vulnerabilities, but most are errors in interpretation—they treat benign user input as code or fail to distinguish input from system commands. Many examples of interpretation errors can exist outside of computer science, such as the comedy routine "Who's on First?". Code injection can be used maliciously for many purposes, including:
Code injections that target the Internet of Things could also lead to severe consequences such as data breaches and service disruption.
Code injections can occur on any type of program running with an interpreter. Doing this is trivial to most, and one of the primary reasons why server software is kept away from users. An example of how an injector can see code injection first-hand is to use their .
Code injection vulnerabilities are recorded by the National Institute of Standards and Technology in the National Vulnerability Database as CWE-94. Code injection peaked in 2008 at 5.66% as a percentage of all recorded vulnerabilities.

Benign and unintentional use

Code injection may be done with good intentions. For example, changing or tweaking the behavior of a program or system through code injection can cause the system to behave in a certain way without malicious intent. Code injection could, for example:
  • Introduce a useful new column that did not appear in the original design of a search results page.
  • Offer a new way to filter, order, or group data by using a field not exposed in the default functions of the original design.
  • Add functionality like connecting to online resources in an offline program.
  • Override a function, making calls redirect to another implementation. This can be done with the Dynamic linker in Linux.
Some users may unsuspectingly perform code injection because the input they provided to a program was not considered by those who originally developed the system. For example:
  • What the user may consider as valid input may contain token characters or strings that have been reserved by the developer to have special meaning.
  • The user may submit a malformed file as input that is handled properly in one application but is toxic to the receiving system.
Another benign use of code injection is the discovery of injection flaws to find and fix vulnerabilities. This is known as a penetration test.

Preventing Code Injection

To prevent code injection problems, the person could use secure input and output handling strategies, such as:
  • Using an application programming interface that, if used properly, is secure against all input characters. Parameterized queries allow the moving of user data out of a string to be interpreted. Additionally, Criteria API and similar APIs move away from the concept of command strings to be created and interpreted.
  • Enforcing language separation via a static type system.
  • Validating or "sanitizing" input, such as whitelisting known good values. This can be done on the client side, which is prone to modification by malicious users, or on the server side, which is more secure.
  • Encoding input or escaping dangerous characters. For instance, in PHP, using the htmlspecialchars function to escape special characters for safe output of text in HTML and the mysqli::real_escape_string function to isolate data which will be included in an SQL request can protect against SQL injection.
  • Encoding output, which can be used to prevent XSS attacks against website visitors.
  • Using the HttpOnly flag for HTTP cookies. When this flag is set, it does not allow client-side script interaction with cookies, thereby preventing certain XSS attacks.
  • Modular shell disassociation from the kernel.
  • Regarding SQL injection, one can use parameterized queries, stored procedures, whitelist input validation, and other approaches to help mitigate the risk of an attack. Using object-relational mapping can further help prevent users from directly manipulating SQL queries.
The solutions described above deal primarily with web-based injection of HTML or script code into a server-side application. Other approaches must be taken, however, when dealing with injections of user code on a user-operated machine, which often results in privilege elevation attacks. Some approaches that are used to detect and isolate managed and unmanaged code injections are:
  • Runtime image hash validation, which involves capturing the hash of a partial or complete image of the executable loaded into memory and comparing it with stored and expected hashes.
  • NX bit: all user data is stored in special memory sections that are marked as non-executable. The processor is made aware that no code exists in that part of memory and refuses to execute anything found in there.
  • Use canaries, which are randomly placed values in a stack. At runtime, a canary is checked when a function returns. If a canary has been modified, the program stops execution and exits. This occurs on a failed Stack Overflow Attack.
  • Code Pointer Masking : after loading a code pointer into a register, the user can apply a bitmask to the pointer. This effectively restricts the addresses to which the pointer can refer. This is used in the C programming language.

    Examples

SQL injection

An SQL injection takes advantage of SQL syntax to inject malicious commands that can read or modify a database or compromise the meaning of the original query.
For example, consider a web page that has two text fields which allow users to enter a username and a password. The code behind the page will generate an SQL query to check the password against the list of user names:

SELECT UserList.Username
FROM UserList
WHERE UserList.Username = 'Username'
AND UserList.Password = 'Password'

If this query returns any rows, then access is granted. However, if the malicious user enters a valid Username and injects some valid code " in the Password field, then the resulting query will look like this:

SELECT UserList.Username
FROM UserList
WHERE UserList.Username = 'Username'
AND UserList.Password = 'Password' OR '1'='1'

In the example above, "Password" is assumed to be blank or some innocuous string. "'1'='1'" will always be true and many rows will be returned, thereby allowing access.
The technique may be refined to allow multiple statements to run or even to load up and run external programs.
Assume a query with the following format:
SELECT User.UserID
FROM User
WHERE User.UserID = ' " + UserID + " '
AND User.Pwd = ' " + Password + " '
If an adversary has the following for inputs:
UserID: ';DROP TABLE User; --'
Password: 'OR"='
then the query will be parsed as:
SELECT User.UserID
FROM User
WHERE User.UserID = ;DROP TABLE User; --'AND Pwd = OR"='

The resulting User table will be removed from the database. This occurs because the ; symbol signifies the end of one command and the start of a new one. -- signifies the start of a comment.

Cross-site scripting

Code injection is the malicious injection or introduction of code into an application. Some web servers have a guestbook script, which accepts small messages from users and typically receives messages such as:
Very nice site!
However, a malicious person may know of a code injection vulnerability in the guestbook and enter a message such as:
Nice site, I think I'll take it.
If another user views the page, then the injected code will be executed. This code can allow the attacker to impersonate another user. However, this same software bug can be accidentally triggered by an unassuming user, which will cause the website to display bad HTML code.
HTML and script injection are popular subjects, commonly termed "cross-site scripting" or "XSS". XSS refers to an injection flaw whereby user input to a web script or something along such lines is placed into the output HTML without being checked for HTML code or scripting.
Many of these problems are related to erroneous assumptions of what input data is possible or the effects of special data.