Identify Code Injection Vulnerabilities with Kiuwan

Code injection is a general term for a type of software vulnerability where unvalidated input is evaluated by an application. It is fairly common on web applications that rely on user input through forms that lack appropriate input/output data validation. This flaw can be exploited by attackers by injecting malicious code in the language of the application into it, which will then be executed by the server-side interpreter for that language. 

Consequences of code injection can be dire: 

• Data loss

• Data corruption

• Lack of accountability

• Denial of access

• Host takeover

What differs code injection from command injection is that an attacker is only limited by the functionality of the injected language. If the language of the target application is Java, the injection is limited by what Java is capable of. 

• SQL injection

• Cross-site scripting

• PHP object injection

• Remote file injection (file inclusion vulnerability)

• Format specifier injection (format string attack)

Validate and sanitize inputs

Accept only a limited set of values via whitelisting or conditional switching.

Use a SAST solution

Use a code analysis tool like Kiuwan to test for vulnerabilities related to code injection.

Least privilege

Give the account the database calls run under only limited privileges, like select.   

Avoid vulnerable evaluation constructs

Use dedicated, language-specific features to safely process user-supplied arguments.