Direct Static Code Injection - Revision history

Andrew Smith: Merge with code injection attack

2014-11-11T14:59:26Z

Merge with code injection attack

KirstenS at 12:40, 7 April 2009

2009-04-07T12:40:47Z

KirstenS at 19:09, 15 February 2009

2009-02-15T19:09:04Z

KirstenS: /* Description */

2008-09-18T12:48:25Z

‎Description

KirstenS: /* Example 1 */

2008-09-14T12:04:16Z

‎Example 1

KirstenS at 01:19, 14 September 2008

2008-09-14T01:19:23Z

KirstenS: /* Related Controls */

2008-09-12T22:38:55Z

‎Related Controls

KirstenS: /* Related Attacks */

2008-09-12T22:38:41Z

‎Related Attacks

KirstenS: /* Example 2 */

2008-09-11T12:47:58Z

‎Example 2

KirstenS: /* Example 1 */

2008-09-11T12:47:13Z

‎Example 1

← Older revision		Revision as of 14:59, 11 November 2014
Line 7:		Line 7:
	==Description==		==Description==

−	A Direct Static Code Injection attack consists of injecting code directly onto the resource used by application while processing a user request. This is normally performed by tampering libraries and template files which are created based on user input without proper data sanitization.	+	See [[Code Injection]]
−	~~Upon a user request to the modified resource, the actions defined in it will be executed at server side in the context of web server process.~~
−
−	~~[[Server-Side Includes (SSI) Injection \| Server Side Includes]] is considered a type of direct static code injection. It should not be confused with other types of code injection, like~~ [[~~Cross-site Scripting (XSS)\| XSS]] (“Cross-site scripting” or “HTML injection”) where the code is executed on the client side.~~
−
−	~~==Risk Factors==~~
−	~~TBD~~
−	~~[[Category:FIXME\|need content here]]~~
−
−	~~==Examples==~~
−
−	~~===Example 1===~~
−	~~This is a simple example of exploitation of a CGISCRIPT.NET csSearch 2.3 vulnerability, published on Bugtraq ID: 4368.~~
−	~~By requesting the following URL to the server, it’s possible to execute commands defined on the ‘’’’setup’’’ variable.~~
−	~~<br>~~
−	~~csSearch.cgi?command=savesetup&setup=''PERL_CODE_HERE''~~
−	~~<br>~~
−	~~For the classic example, the following command can be used to remove all files from “/” folder:~~
−	~~csSearch.cgi?command=savesetup&setup=`rm%20-rf%20/`~~
−
−	~~Note that the above command must be encoded in order to be accepted.~~
−
−	~~===Example 2===~~
−	This example exploits a vulnerability on Ultimate PHP Board (UPB) 1.9 (CVE-2003-0395), which allows an attacker to execute random php code. This happens because some user variables, like IP address and User-Agent, are stored in a file that is used by the admin_iplog.php page to show user statistics. When an administrator browses this page, the previously injected code by a malicious request is executed.
−	~~The following example stores a malicious PHP code that will deface the index.html page when an administrator browses admin_iplog.php.~~
−	~~GET /board/index.php HTTP/1.0~~
−	~~User-Agent: <? system( "echo \'hacked\' > ../index.html" ); ?>~~
−
−	~~==Related [[Threat Agents]]==~~
−	* [[Internal software developer]]
−
−	~~==Related [[Attacks]]==~~
−	* [[Server-Side Includes (SSI) Injection \| Server Side Includes]]
−	* [[ Direct Dynamic Code ~~Evaluation ('Eval Injection')]]~~
−
−	~~==Related [[Vulnerabilities]]==~~
−	* [[:Category:Input Validation Vulnerability]]
−
−	~~==Related [[Controls]]==~~
−	* [[:Category:Input Validation]]
−
−	~~==References==~~
−	* http://www.seclab.tuwien.ac.at/advisories/TUVSA-0510-001.txt
−	* http://marc.info/?l=bugtraq&m=105379741528925&w=2
−	* http://archives.neohapsis.com/archives/bugtraq/2005-06/0002.html
−
−
−	~~[[Category:~~Injection]]
−	~~[[Category:Attack]]~~
−	~~__NOTOC__~~

@@ Line 2: / Line 2: @@
 <br>
 [[Category:OWASP ASDR Project]]
-[[ASDR Table of Contents]]
 Last revision: '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

@@ Line 2: / Line 2: @@
 <br>
 [[Category:OWASP ASDR Project]]
-[[ASDR Table of Contents]]__TOC__
+[[ASDR Table of Contents]]
 Last revision: '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

@@ Line 10: / Line 10: @@
 Upon a user request to the modified resource, the actions defined in it will be executed at server side in the context of web server process.
-[[Server-Side Includes (SSI) Injection | Server Side Includes]] is considered a type of direct static code injection. It should not be confused with other types of code injection, like [[Cross-site scripting | XSS]] (“Cross-site scripting” or “HTML injection”) where the code is executed on the client side.
+[[Server-Side Includes (SSI) Injection | Server Side Includes]] is considered a type of direct static code injection. It should not be confused with other types of code injection, like [[Cross-site Scripting (XSS)| XSS]] (“Cross-site scripting” or “HTML injection”) where the code is executed on the client side.
 ==Risk Factors==

@@ Line 24: / Line 24: @@
   csSearch.cgi?command=savesetup&setup=''PERL_CODE_HERE''
 <br>
-For the classical example, the following command can be used to remove all files from “/” folder:
+For the classic example, the following command can be used to remove all files from “/” folder:
 csSearch.cgi?command=savesetup&setup=`rm%20-rf%20/`

@@ Line 36: / Line 36: @@
 ==Related [[Threat Agents]]==
 * [[Internal software developer]]
 ==Related [[Attacks]]==
 * [[Server-Side Includes (SSI) Injection | Server Side Includes]]
-*[[Server-Side Includes (SSI) Injection | Server Side Includes]]
+* [[ Direct Dynamic Code Evaluation ('Eval Injection')]]
 ==Related [[Vulnerabilities]]==
 * [[:Category:Input Validation Vulnerability]]
 ==Related [[Controls]]==
 * [[:Category:Input Validation]]
 ==References==
 * http://www.seclab.tuwien.ac.at/advisories/TUVSA-0510-001.txt
 * http://marc.info/?l=bugtraq&m=105379741528925&w=2
 * http://archives.neohapsis.com/archives/bugtraq/2005-06/0002.html

← Older revision		Revision as of 22:38, 12 September 2008
Line 51:		Line 51:

	* [[:Category:Input Validation]]		* [[:Category:Input Validation]]
−

	==References==		==References==

@@ Line 30: / Line 30: @@
 ===Example 2===
-This example exploits a vulnerability on Ultimate PHP Board (UPB) 1.9 (CVE-2003-0395), which allows an attacker to execute random php code. This happens because some user variables, like IP address and User-Agent, are stored in a file that is used by admin_iplog.php page to show user statistics. When an administrator browses this page, the previously injected code by a malicious request is executed.
+This example exploits a vulnerability on Ultimate PHP Board (UPB) 1.9 (CVE-2003-0395), which allows an attacker to execute random php code. This happens because some user variables, like IP address and User-Agent, are stored in a file that is used by the admin_iplog.php page to show user statistics. When an administrator browses this page, the previously injected code by a malicious request is executed.
-The following example stores a malicious PHP code that will deface index.html page when administrator browses admin_iplog.php.
+The following example stores a malicious PHP code that will deface the index.html page when an administrator browses admin_iplog.php.
   GET /board/index.php HTTP/1.0
   User-Agent: <? system( "echo \'hacked\' > ../index.html" ); ?>
 ==Related [[Threat Agents]]==

@@ Line 19: / Line 19: @@
 ===Example 1===
-This is a simple example of exploitation of CGISCRIPT.NET csSearch 2.3 vulnerability, published on Bugtraq ID: 4368.
+This is a simple example of exploitation of a CGISCRIPT.NET csSearch 2.3 vulnerability, published on Bugtraq ID: 4368.
-By requesting the following URL to the server, it’s possible to execute commands defined on ‘’’’setup’’’ variable.
+By requesting the following URL to the server, it’s possible to execute commands defined on the ‘’’’setup’’’ variable.
 <br>
   csSearch.cgi?command=savesetup&setup=''PERL_CODE_HERE''
 <br>
-For the classical example, it can be used the following command to remove all files from “/” folder:
+For the classical example, the following command can be used to remove all files from “/” folder:
 csSearch.cgi?command=savesetup&setup=`rm%20-rf%20/`
 Note that the above command must be encoded in order to be accepted.
 ===Example 2===