Lably
Skip to content

Code injection

Computer security exploit using injected code

  • 14 min read
  • 3 chapters

Related on Lably

Through Computer program, Computer and Malware

Lab · Class 8–12AR Marker TrackingLab · Class 11Binary and Logic GatesLab · Class 10–12Handwriting RecognizerLab · Class 12Networking Basics

Code injection vulnerabilities occur when an application sends untrusted data to an interpreter, which then executes the injected text as code. Injection flaws are often found in services like Structured Query Language (SQL) databases, Extensible Markup Language (XML) parsers, operating system commands, Simple Mail Transfer Protocol (SMTP) headers, and other program arguments. Injection flaws can be identified through source code examination, Static analysis, or dynamic testing methods such as fuzzing.

There are numerous types of code injection vulnerabilities, but most are errors in interpretation—they treat benign user input as code or fail to distinguish input from system commands. Many examples of interpretation errors can exist outside of computer science, such as the comedy routine "Who's on First?". Code injection can be used maliciously for many purposes, including:

  • Arbitrarily modifying values in a database through SQL injection; the impact of this can range from website defacement to serious compromise of sensitive data. For more information, see Arbitrary code execution.
  • Installing malware or executing malevolent code on a server by injecting server scripting code (such as PHP).
  • Privilege escalation to either superuser permissions on UNIX by exploiting shell injection vulnerabilities in a binary file or to Local System privileges on Microsoft Windows by exploiting a service within Windows.
  • Attacking web users with Hyper Text Markup Language (HTML) or Cross-Site Scripting (XSS) injection.

Code injections that target the Internet of Things could also lead to severe consequences such as data breaches and service disruption.

Code injections can occur on any type of program running with an interpreter. Doing this is trivial to most, and one of the primary reasons why server software is kept away from users. An example of how an injector can see code injection first-hand is to use their browser's developer tools.

Code injection vulnerabilities are recorded by the National Institute of Standards and Technology (NIST) in the National Vulnerability Database (NVD) as CWE-94. Code injection peaked in 2008 at 5.66% as a percentage of all recorded vulnerabilities.

Benign and unintentional use

Code injection may be done with good intentions. For example, changing or tweaking the behavior of a program or system through code injection can cause the system to behave in a certain way without malicious intent. Code injection could, for example:

  • Introduce a useful new column that did not appear in the original design of a search results page.
  • Offer a new way to filter, order, or group data by using a field not exposed in the default functions of the original design.
  • Add functionality like connecting to online resources in an offline program.
  • Override a function, making calls redirect to another implementation. This can be done with the Dynamic linker in Linux.

Some users may unsuspectingly perform code injection because the input they provided to a program was not considered by those who originally developed the system. For example:

  • What the user may consider as valid input may contain token characters or strings that have been reserved by the developer to have special meaning (such as the ampersand or quotation marks).
  • The user may submit a malformed file as input that is handled properly in one application but is toxic to the receiving system.

Another benign use of code injection is the discovery of injection flaws to find and fix vulnerabilities. This is known as a penetration test.

Sign in to keep reading

2 more chapters are free with a Lably account.

More in Computing and communication

ISBNUnique numeric book identifier since 1970X (social network)American social networking serviceWayback MachineDigital archive by the Internet ArchivePython (programming language)General-purpose programming languageMacOSOperating system for Apple computersUnicodeCharacter encoding standard