CERT
Skip to end of metadata
Go to start of metadata

The C Standard system() function executes a specified command by invoking an implementation-defined command processor, such as a UNIX shell or CMD.EXE in Microsoft Windows. The POSIX popen() and Windows _popen() functions also invoke a command processor but create a pipe between the calling program and the executed command, returning a pointer to a stream that can be used to either read from or write to the pipe [IEEE Std 1003.1:2013]. 

Use of the system() function can result in exploitable vulnerabilities, in the worst case allowing execution of arbitrary system commands. Situations in which calls to system() have high risk include the following: 

  • When passing an unsanitized or improperly sanitized command string originating from a tainted source
  • If a command is specified without a path name and the command processor path name resolution mechanism is accessible to an attacker
  • If a relative path to an executable is specified and control over the current working directory is accessible to an attacker
  • If the specified executable program can be spoofed by an attacker

Do not invoke a command processor via system() or equivalent functions to execute a command. 

Noncompliant Code Example

In this noncompliant code example, the system() function is used to execute any_cmd in the host environment. Invocation of a command processor is not required.

If this code is compiled and run with elevated privileges on a Linux system, for example, an attacker can create an account by entering the following string:

The shell would interpret this string as two separate commands:

and create a new user account that the attacker can use to access the compromised system.

This noncompliant code example also violates STR02-C. Sanitize data passed to complex subsystems.

Compliant Solution (POSIX)

In this compliant solution, the call to system() is replaced with a call to execve(). The exec family of functions does not use a full shell interpreter, so it is not vulnerable to command-injection attacks, such as the one illustrated in the noncompliant code example.

The execlp(), execvp(), and (nonstandard) execvP() functions duplicate the actions of the shell in searching for an executable file if the specified file name does not contain a forward slash character (/). As a result, they should be used without a forward slash character (/) only if the PATH environment variable is set to a safe value, as described in ENV03-C. Sanitize the environment when invoking external programs.

The execl(), execle(), execv(), and execve() functions do not perform path name substitution.

Additionally, precautions should be taken to ensure the external executable cannot be modified by an untrusted user, for example, by ensuring the executable is not writable by the user.

This compliant solution is significantly different from the preceding noncompliant code example. First, input is incorporated into the args array and passed as an argument to execve(), eliminating concerns about buffer overflow or string truncation while forming the command string. Second, this compliant solution forks a new process before executing "/usr/bin/any_cmd" in the child process. Although this method is more complicated than calling system(), the added security is worth the additional effort.

The exit status of 127 is the value set by the shell when a command is not found, and POSIX recommends that applications should do the same. XCU, Section 2.8.2, of Standard for Information Technology—Portable Operating System Interface (POSIX®), Base Specifications, Issue 7 [IEEE Std 1003.1:2013], says

If a command is not found, the exit status shall be 127. If the command name is found, but it is not an executable utility, the exit status shall be 126. Applications that invoke utilities without using the shell should use these exit status values to report similar errors.

Compliant Solution (Windows)

This compliant solution uses the Microsoft Windows CreateProcess() API:

This compliant solution relies on the input parameter being non-const. If it were const, the solution would need to create a copy of the parameter because the CreateProcess() function can modify the command-line arguments to be passed into the newly created process.

This solution creates the process such that the child process does not inherit any handles from the parent process, in compliance with WIN03-C. Understand HANDLE inheritance.

Noncompliant Code Example (POSIX)

This noncompliant code invokes the C system() function to remove the .config file in the user's home directory.

If the vulnerable program has elevated privileges, an attacker can manipulate the value of the HOME environment variable such that this program can remove any file named .config anywhere on the system.

Compliant Solution (POSIX)

An alternative to invoking the system() call to execute an external program to perform a required operation is to implement the functionality directly in the program using existing library calls. This compliant solution calls the POSIX unlink() function to remove a file without invoking the system() function [IEEE Std 1003.1:2013]

The unlink() function is not susceptible to a symlink attack where the final component of pathname (the file name) is a symbolic link because unlink() will remove the symbolic link and not affect any file or directory named by the contents of the symbolic link. (See FIO01-C. Be careful using functions that use file names for identification.)  While this reduces the susceptibility of the unlink() function to symlink attacks, it does not eliminate it.  The unlink() function is still susceptible if one of the directory names included in the pathname is a symbolic link.  This could cause the unlink() function to delete a similarly named file in a different directory.

Compliant Solution (Windows)

This compliant solution uses the Microsoft Windows SHGetKnownFolderPath() API to get the current user's My Documents folder, which is then combined with the file name to create the path to the file to be deleted. The file is then removed using the DeleteFile() API.

Exceptions

ENV33-C-EX1: It is permissible to call system() with a null pointer argument to determine the presence of a command processor for the system.

 Risk Assessments

If the command string passed to system(), popen(), or other function that invokes a command processor is not fully sanitized, the risk of exploitation is high. In the worst case scenario, an attacker can execute arbitrary system commands on the compromised machine with the privileges of the vulnerable process.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

ENV33-C

High

Probable

Medium

P12

L1

Automated Detection

Tool

Version

Checker

Description

Astrée17.04i Supported, but no explicit checker
Clang3.9cert-env33-cChecked by clang-tidy
CodeSonar4.4

BADFUNC.PATH.SYSTEM
IO.INJ.COMMAND

Use of system
Command injection

Compass/ROSE   
Coverity2017.07DONT_CALLImplemented
Klocwork2017

MISRA.STDLIB.ABORT
SV.CODE_INJECTION.SHELL_EXEC

SV.TAINTED.INJECTION

 
LDRA tool suite9.5.6

588 S

Fully implemented
Parasoft C/C++test9.5MISRA2012-RULE-21_8Also detects getenv(), abort(), and exit()
Polyspace Bug FinderR2016a

Execution of externally controlled command, Command executed from externally controlled path

Command argument from an unsecure source vulnerable to operating system command injection

Path argument from an unsecure source

PRQA QA-C9.35018Partially implemented
PRQA QA-C++4.1

5031

 
RuleChecker17.04i Supported, but no explicit checker
SonarQube C/C++ Plugin3.11S990Detects uses of "abort", "exit", "getenv" and "system" from <stdlib.h> 

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

[IEEE Std 1003.1:2013]XSH, System Interfaces, exec
XSH, System Interfaces, popen
XSH, System Interfaces, unlink
[Wheeler 2004] 

 


 

12 Comments

  1. An empty environment is unfair to any_exe; it should include PATH, HOME, TZ and maybe a few more, at minimum.

    We should not be using implicit int functions - like the compliant solution is.

    Isn't there a rule about cleaning user input before using it -- this code violates that (that might be STR02-A).

    There's still a puts() that would be better as perror().

    Should the solution have the parent wait like the system() call does?

    Should the solution deal with signals like system() probably does?

    The non-compliant solution doesn't check the return from snprintf() as it should - which is just another thing that makes it non-compliant.

    Suffice to say - more work needed before this is ready for prime time. 

    1. Fixed all your issues. A few comments:

      Sanitizing the environment or arguments is indeed covered more generally by STR02-A. Exactly how the env or args should be sanitized depends on the overall program design. Also consider that an attacker with shell access can always invoke programs directly with 'hostile' args and env, so sanitization may buy you nothing...it all depends ont the program design. As such, I added the 'sanitize parms' comment instead of doing anything more substantial (smile)

      Re signals: Good question. I guess if the exec'd command has special behavior wrt signals, and that special behavior is part of the design, then the example should catch signals & pass them to the child. Unless there is a specific vul wrt signals and 'exec', I don't think the examples should 'handle' signals.

      1. Getting signals right is tricky.  For example, before the waitpid should be a reset of SIGINT, SIGQUIT, and any other signals that might have a signal handler function established, to SIG_IGN; but reset SIGCLD to SIG_DFL; restore the original state after the waitpid.  The execed process inherits the SIG_IGN and SIG_DFL states.  It is almost certainly an error to forward signals to the child process.

  2. Wietse Venema sez:

    The example has two bugs:

    1) It may pick up the status from the wrong child. An attacker
    could exploit this race condition by 'exec'-ing the program from
    a process that already has a child, and have that child exit first.

    2) It ignores the child exit status. One could argue that this
    violates "ERR00-A. Detect errors by checking return values".

    To fix:

    Use WIFEXITED() etc. to examine the status result.

    1. Not sure where the "Wietse Venema sez" quote is from, since there's no comment on this page by anyone called Wietse Venema and the quote doesn't match the code on the actual page itself, which uses a waitpid() call and passes it the pid returned by fork().

      The suggested "fix" is poor practice as it obtains and throws away the status for other children.

      However, adding code to check the exit status with WIFEXITED() and WEXITSTATUS() is a good idea.

      1. we sometimes get comments sent in by email.

  3. In terms of the CWE references: CWE 78 and 88 are indirect but you probably could make an argument for these references.  But the main reference here should probably be CWE 77.

  4. Why not just use popen()?

    1. The POSIX popen() function also invokes a command processor.

  5. The following recently updated paragraph is not correct:

     Click here to expand...

    The unlink() function is not susceptible to file-related race conditions (see FIO01-C. Be careful using functions that use file names for identification) because if file names a symbolic link, unlink() will remove the symbolic link named by file and not affect any file or directory named by the contents of the symbolic link.

    The fact that unlink() operates on symbolic links only reduces its susceptibility to FIO01-C, it does not eliminate it.  It is not susceptible as regards the final component of the pathname being a symbolic link, but it is still susceptible if the pathname contains a symbolic link in an earlier component, e.g. /tmp/symlink_to_dir/somefile.

     

    1. I fixed some of this language.  Todo is to revisit the compliant solution.  In general, the appropriate solution to this problem is to drop privileges to the RUID.  Alternatively, we could canonicalize the filename and validate.

  6. A compliant solution using http://pubs.opengroup.org/onlinepubs/9699919799/functions/posix_spawn.html may be helpful. Unix implementers are more likely to get details such as signal handlers and file descriptors correct if they use the modern API where such details are explicit. It also would provide more symmetry with the compliant Windows solution.