CVE-2024-20359 - Improper Control of Generation of Code ('Code Injection')

This example attempts to write user messages to a message file and allow users to view them.

               
}
echo "Message Saved!<p>\n";
include($MessageFile);

While the programmer intends for the MessageFile to only include data, an attacker can provide a message such as:

               
message=%3C?php%20system(%22/bin/ls%20-l%22);?%3E

which will decode to the following:

               
<?php system("/bin/ls -l");?>

The programmer thought they were just including the contents of a regular data file, but PHP parsed it and executed the code. Now, this code is executed any time people view messages.

Notice that XSS (CWE-79) is also possible in this situation.

edit-config.pl: This CGI script is used to modify settings in a configuration file.

               
}

                     

                           # code to add a field/key to a file goes here

                     

                           # code to set key to a particular file goes here

                     

                           # code to delete key from a particular file goes here

                     
eval($code);# this is super-efficient code, especially if you have to invoke# any one of dozens of different functions!
handleConfigAction($configfile, param('action'));
print "No action specified!\n";

The script intends to take the 'action' parameter and invoke one of a variety of functions based on the value of that parameter - config_file_add_key(), config_file_set_key(), or config_file_delete_key(). It could set up a conditional to invoke each function separately, but eval() is a powerful way of doing the same thing in fewer lines of code, especially when a large number of functions or variables are involved. Unfortunately, in this case, the attacker can provide other values in the action parameter, such as: add_key(",","); system("/bin/ls"); This would produce the following string in handleConfigAction(): config_file_add_key(",","); system("/bin/ls"); Any arbitrary Perl code could be added after the attacker has "closed off" the construction of the original function call, in order to prevent parsing errors from causing the malicious eval() to fail before the attacker's payload is activated. This particular manipulation would fail after the system() call, because the "_key(\$fname, \$key, \$val)" portion of the string would cause an error, but this is irrelevant to the attack because the payload has already been activated.