Қателі деректерден туындаған компьютерлік қателіктерді пайдалану

Computer bug exploit caused by invalid data

Code injection is the exploitation of a computer bug that is caused by processing invalid data. The injection is used by an attacker to introduce (or "inject") code into a vulnerable computer program and change the course of execution. The result of successful code injection can be disastrous, for example, by allowing computer viruses or computer worms to propagate. Code injection vulnerabilities occur when an application sends untrusted data to an interpreter. Injection flaws are most often found in SQL, LDAP, XPath, NoSQL queries, OS commands, XML parsers, SMTP headers, program arguments, etc. Injection flaws tend to be easier to discover when examining source code than via testing. Scanners and fuzzers can help find injection flaws. Injection can result in data loss or corruption, lack of accountability, or denial of access. Injection can sometimes lead to complete host takeover. Certain types of code injection are errors in interpretation, giving special meaning to user input. Similar interpretation errors exist outside the world of computer science such as the comedy routine Who's on First?. In the routine, there is a failure to distinguish proper names from regular words. Likewise, in some types of code injection, there is a failure to distinguish user input from system commands. Code injection techniques are popular in system hacking or cracking to gain information, privilege escalation or unauthorized access to a system. Code injection can be used malevolently for many purposes, including:
Arbitrarily modifying values in a database through SQL injection. The impact of this can range from website defacement to serious compromise of sensitive data. Installing malware or executing malevolent code on a server by injecting server scripting code (such as PHP or ASP). Privilege escalation to root permissions by exploiting shell injection vulnerabilities in a setuid root binary on UNIX, or Local System by exploiting a service on Microsoft Windows. Attacking web users with HTML/script injection (Cross site scripting). Code injection attacks in Internet of Things could also lead to severe consequences like data breaches and service disruption. In 2008, 5.66% of all vulnerabilities reported that year were classified as code injection, the highest year on record. In 2015, this had decreased to 0.77%.

Code injection may be used with good intentions; for example, changing or tweaking the behavior of a program or system through code injection can cause the system to behave in a certain way without any malicious intent. Code injection could, for example:
Introduce a useful new column that did not appear in the original design of a search results page. Offer a new way to filter, order, or group data by using a field not exposed in the default functions of the original design. As regards programs like Dropbox, add special parts that could be used to connect to online resources in an offline program. Utilize the Linux Dynamic Linker to define a function with the same name as certain libc functions, link that function as a library, and override the use of the libc function. Some users may unsuspectingly perform code injection because input they provide to a program was not considered by those who originally developed the system. For example:
What the user may consider a valid input may contain token characters or character strings that have been reserved by the developer to have special meaning (perhaps the "&" in "Shannon & Jason," or quotation marks as in "Bub 'Slugger' McCracken"). The user may submit a malformed file as input that is handled gracefully in one application, but is toxic to the receiving system. Another benign use of code injection could be the discovery of injection flaws themselves, with the intention of fixing these flaws. This is known as a white hat penetration test.

Template engines are often used in modern Web application to display dynamic data. However, trusting non validated user data can frequently lead to critical vulnerabilities such as Server Side Template Injections. While this vulnerability is similar to Cross site scripting, template injection can be leverage to execute code on the web server rather than in a visitor's browser. It abuses a common workflow of web applications which often use user inputs and templates to render a web page. The example below shows the concept. Here the template visitor name is replaced with data during the rendering process. Hello visitor nameAn attacker can use this workflow to inject code into the rendering pipeline by providing a malicious visitor name. Depending on the implementation of the web application, he could choose to inject 7*'7' which the renderer could resolve to Hello 7777777. Note that the actual web server has evaluated the malicious code and therefore could be vulnerable to Remote code execution.

PHP allows serialization and deserialization of whole objects. If untrusted input is allowed into the deserialization function, it is possible to overwrite existing classes in the program and execute malicious attacks. Such an attack on Joomla was found in 2013.