This article appears to contain a large number of buzzwords. (September 2024) |
Code injections are a class of computer security exploits in which a vulnerable computer program misinterprets external data (usually user input) as part of its code. An attacker thereby "injects" code into the program, changing the course of its execution. The result of successful code injection can have major consequences, for example, by allowing computer viruses or computer worms to propagate.
Code injection vulnerabilities occur when an application sends untrusted data to an interpreter. Injection flaws are often found in SQL, LDAP, XPath, NoSQL queries, OS commands, XML parsers, SMTP headers, program arguments, etc. Injection flaws are more straightforward to discover when examining source code than when testing.[1] Static analysis and fuzzers can help find injection flaws.[2]
Code injections can result in data loss or corruption, lack of accountability, denial of access, and in some cases, complete host takeover.
Certain types of code injection are errors in interpretation, giving special meaning to user input. Similar interpretation errors exist outside computer science, such as the comedy routine "Who's on First?". In some types of code injection, there is a failure to distinguish user input from system commands.
Code injection techniques are popular in system hacking or cracking to gain information, as well as privilege escalation or unauthorized access to a system. Code injection can be used maliciously for many purposes, including:
Code injections that attack in Internet of Things could also lead to severe consequences like data breaches and service disruption.[3]
In 2008, 5.66% of all vulnerabilities reported that year were classified as code injection, the highest year on record. In 2015, this had decreased to 0.77%.[4]