Code injection in Java - Revision history

Neil Bergman: /* Examples */

2009-09-24T13:03:12Z

‎Examples

Neil Bergman: /* Overview */

2009-09-24T13:01:00Z

‎Overview

Neil Bergman: /* Overview */

2009-09-24T12:58:35Z

‎Overview

Neil Bergman at 12:30, 16 September 2009

2009-09-16T12:30:36Z

Neil Bergman: Created page with '==Status== Review ==Overview== Code injection simply involves injecting malicious code into an application, which will be executed in the context of the application. Java prov…'

2009-09-15T05:30:18Z

Created page with '==Status== Review ==Overview== Code injection simply involves injecting malicious code into an application, which will be executed in the context of the application. Java prov…'

New page

==Status==
Review

==Overview==

Code injection simply involves injecting malicious code into an application, which will be executed in the context of the application. Java provides a scripting API that allows code written in scripting languages to access and control Java objects. The scripting API comes with built-in support for Javascript using the Mozilla Rhino engine, but other language engines such as JRuby and Jython can be used as well. If an attacker can control which script file is loaded or part of the script code that is evaluated, then malicious code can be executed.

==Examples ==

===Example 1===

The code below allows a user to inject arbitrary Javascript into Java's script engine.

<pre>
import javax.script.*;

public class Example1 {
public static void main(String[] args) {
try {
ScriptEngineManager manager = new ScriptEngineManager();
ScriptEngine engine = manager.getEngineByName("JavaScript");
System.out.println(args[0]);
engine.eval("print('"+ args[0] + "')");
} catch(Exception e) {
e.printStackTrace();
}
}
}
</pre>

In this case, the attacker decides to inject code that creates a file on the file system.

hallo'); var fImport = new JavaImporter(java.io.File); with(fImport) { var f = new File('new'); f.createNewFile(); } //

There are two built-in functions that allow Java classes and packages to be brought into the scripting environment: importPacket and importClass. There is also a class, called JavaImporter, which allows multiple Java packages to be brought into the script code and then can be used to instantiate Java classes.

← Older revision		Revision as of 13:03, 24 September 2009
Line 57:		Line 57:

	It is trivial for a user to load script files from other directories. For example, inputting ''../uploads/evil''. The restriction on the filename can be bypassed using a null byte character depending on how the file is opened.		It is trivial for a user to load script files from other directories. For example, inputting ''../uploads/evil''. The restriction on the filename can be bypassed using a null byte character depending on how the file is opened.
		+
		+	===Example 3===
		+
		+	The code below allows the user to control which JSP is loaded using a dynamic include. This is similar to the PHP include statement, but doesn't not allow the inclusion of code from other domains.
		+
		+	<pre>
		+	<% String pageToInclude = getDataFromUntrustedSource(); %>
		+	<jsp:include page="<%=pageToInclude %>" />
		+	</pre>

@@ Line 4: / Line 4: @@
 ==Overview==
-Code injection simply involves injecting malicious code into an application, which will be executed in the context of the application.  There are a couple ways in which Java code could be injected into application such as using the Java scripting API or dynamic JSP includes.  Java provides a scripting API that allows code written in scripting languages to access and control Java objects.  The scripting API comes with built-in support for Javascript using the Mozilla Rhino engine, but other language engines such as JRuby and Jython can be used as well.  If an attacker can control which script file is loaded or part of the script code that is evaluated, then malicious code can be executed.
+Code injection simply involves injecting malicious code into an application, which will be executed in the context of the application.  There are a couple ways in which Java code could be injected into an application such as using the scripting API or dynamic JSP includes.  Java provides a scripting API that allows code written in scripting languages to access and control Java objects.  The scripting API comes with built-in support for Javascript using the Mozilla Rhino engine, but other language engines such as JRuby and Jython can be used as well.  If an attacker can control which script file is loaded or part of the script code that is evaluated, then malicious code can be executed.
 ==Examples ==

← Older revision		Revision as of 12:30, 16 September 2009
Line 34:		Line 34:

	There are two built-in functions that allow Java classes and packages to be brought into the scripting environment: importPacket and importClass. There is also a class, called JavaImporter, which allows multiple Java packages to be brought into the script code and then can be used to instantiate Java classes.		There are two built-in functions that allow Java classes and packages to be brought into the scripting environment: importPacket and importClass. There is also a class, called JavaImporter, which allows multiple Java packages to be brought into the script code and then can be used to instantiate Java classes.
		+
		+	===Example 2===
		+
		+	The code below allows a user to control which file is loaded into Java's script engine.
		+
		+	<pre>
		+	import javax.script.*;
		+	import java.io.*;
		+
		+	public class Example2 {
		+	public static void main(String[] args) {
		+	try {
		+	ScriptEngineManager manager = new ScriptEngineManager();
		+	ScriptEngine engine = manager.getEngineByName("JavaScript");
		+	engine.eval(new java.io.FileReader("resources/" + args[0] + ".js"));
		+	} catch(Exception e) {
		+	e.printStackTrace();
		+	}
		+	}
		+	}
		+	</pre>
		+
		+	It is trivial for a user to load script files from other directories. For example, inputting ''../uploads/evil''. The restriction on the filename can be bypassed using a null byte character depending on how the file is opened.