Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) |
| OWASP | A01:2017 - Injection |
| Confidence Level | Low |
| Impact Level | High |
| Likelihood Level | Low |
Description#
Building command strings for Runtime.exec or loadLibrary using string concatenation or formatting with user-influenced variables is unsafe. This allows attackers to inject malicious commands if inputs aren’t properly validated or sanitized.
Impact#
If exploited, attackers could execute arbitrary system commands on the server, leading to data theft, system compromise, or complete control over the application environment. This can result in data breaches, service disruptions, and significant damage to the organization.