Compliance Node Overview
CWE-77 (Improper Neutralization of Special Elements used in a Command) is the broad parent weakness for command injection. It covers not only OS command injection (CWE-78, its child) but also injection in custom command languages and any product-defined command protocols. CWE-77 is defined as: the product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. The Extended Description notes that many protocols and products implement custom command languages beyond OS shells; developers may overlook that these alternative command environments are similarly vulnerable to injection attacks as traditional shell commands. Examples include LDAP injection, XPath injection, NoSQL injection (MongoDB query selector injection), SMTP injection (email header injection), CRLF injection in HTTP headers, log injection, and template engine command injection. Common Consequences include execute unauthorized code or commands with integrity, confidentiality, and availability scope: an attacker can inject delimiter characters (such as semicolons) to terminate one command and initiate another unintended command, granting unauthorized capabilities and privileges. Potential Mitigations include architecture and design (prefer library calls over external processes when feasible); implementation (ensure externally-called commands are statically defined rather than dynamically constructed); input validation (apply accept-known-good strategies using strict allowlists that conform to specifications; reject non-conforming inputs); runtime enforcement (deploy allowlist-based runtime policies restricting non-sanctioned commands); and system configuration (assign restrictive permissions preventing access to privileged files).
Pillar: Cybersecurity · Authority: MITRE Corporation / Common Weakness Enumeration · Version: 1.0.0 · Last updated:
Primary source: https://cwe.mitre.org/data/definitions/77.html
SHA-256 integrity: 3f9f47a4a6ffbb07409892dd37cebadbb2fe080426be2967e541e19e8767cad7
Primary Citations — 12 traced to source
- CWE-77: Improper Neutralization of Special Elements used in a Command (Command Injection) - MITRE Common Weakness Enumeration at https://cwe.mitre.org/data/definitions/77.html
- CWE-77 Definition - the product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component
+ 10 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access