Code injection
Protect your applications against malicious code injection
What is code injection?
Code injection is a type of attack that allows an attacker to inject malicious code into an application through a user input field, which is then executed on the fly. Code injection vulnerabilities are rather rare, but when they do pop up, it is often a case where the developer has attempted to generate code dynamically. Preventing code injection attacks usually comes down to reconsidering the need to dynamically execute code, especially where user input is involved.
About this lesson
In this lesson, you will learn how code injection works and how to protect your applications against it. We will begin by exploiting a code injection vulnerability in a simple application. Then we will analyze the vulnerable code and explore some options for remediation and prevention.
Ready to learn? Buckle your seat belts, put on your hacker's hat, and let's get started!
How does code injection work?
Let's jump into the nitty-gritty details of how this code injection works:
As an attacker, we were able to determine that our input was being injected directly into a Python’s eval() function. The eval function takes a line of Python code and evaluates it.
We escaped out of the initial string by adding a single “ at the start of our payload.
Any text after the initial “ is interpreted as server-side Python code, so we use + to append another string, but this time we accessed the flask.version variable.
The + “ at the end of the injection appends the original closing double quote at the end of the code, simply to avoid syntax errors.
Finally, we URL encoded the payload to ensure that the server receives all characters correctly.
NOTE: Unlike Javascript, eval() in Python can only execute one line of code, which is why we appended strings instead of running commands directly - but be warned, this is still very dangerous!
Impacts of code injection
If a code injection vulnerability exists in an application, the security impact is that an attacker is able to execute arbitrary server-side code.
The ability to execute server-side code can result in a total loss of integrity, availability, and confidentiality within the application. An attacker may also abuse a code injection vulnerability to execute terminal commands on that server and pivot to adjacent systems.
Is code injection common?
Today, code injection is not a very common vulnerability. There is rarely a situation where it would make sense to inject user input into an eval() function. The use of eval() is typically an indication of bad software design, and there is usually a better alternative.
In general, the proliferation of server-side web frameworks and libraries over the last decade has also decreased the need to custom code many tasks, reducing the likelihood that vulnerabilities will be introduced, and increasing the ease of writing sound, secure code.
Having said this, occasionally code injections can still make their way into popular libraries. One pertinent example is in the LinkedIn DustJS templating engine in 2016. If you are interested, check out the full details of the vulnerability.
Despite the rarity of code injection vulnerabilities, they are included in common checks because of their critical severity.
1. Reconsider the need for dynamic code execution
Perhaps the most straightforward of all prevention techniques is to reconsider the need to evaluate any dynamically generated server-side code. Usually, this dynamic code execution is the result of poor software design rather than necessity, so it's always best to consider other ways to achieve the task.
2. Lock down the interpreter
If the interpreter you are using allows, lock it down by limiting the functionality to the minimum amount required by your application in the server configuration.
3. Avoid the use of dangerous functions
In Python, avoid the use of eval() or exec() especially when dealing with user input.
For example, instead of the vulnerable example from the interactive example above, which looks like this:
uppercaseName = eval('"' + name + '"' + '.upper()')
We could remove the eval() function, and simplify our code like this:
uppercaseName = name.upper()
Admittedly this is quite a simple example, but the point is that the vulnerability arises because dynamic data is being passed into the eval() function.
4. Utilize a static analysis tool
Adding a static application security testing (SAST) tool to your devops pipeline as an additional line of defence is an excellent way to catch vulnerabilities before they make it to production. There are many, but Snyk Code our personal favorite, as it scans in real-time, provides actionable remediation advice, and is available from your favorite IDE.
5. Use a security linter
Use a security linter. If you are using Python developer, there's a good chance that you're already using linters to enforce the uniformity of your code, why not use one to improve security, too?
That's where flake8-bandit comes in. In order to install it, make sure you have flake8 installed, then run the following command:
pip install flake8-bandit
Then select the new bandit linter in your IDE of choice, or run bandit myapp.py from the terminal.
This plugin contains rules that will test your code for vulnerabilities. It's important to note that linters like these will not catch everything. But they are a good sanity check, and the more layers of checks we have the less likely you are to introduce vulnerabilities.
Keep learning
To learn more about code injection, check out some other great content:
Have a look at the OWASP code injection page that goes over some other examples of code injection.
We all love cheatsheets, to check this one here, where you can read about other types of injection and how to prevent them.
If you loved the lesson, don't forget to check out our article about command injection.