What is Improper Control of Generation of Code (CWE-94)?

TL;DR: Improper Control of Generation of Code (‘Code Injection’) (CWE-94) is a critical security vulnerability that occurs when the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. To fix this vulnerability, refactor your program to avoid dynamically generating code, run your code in a sandbox environment, or use input validation techniques.

At-a-Glance

What is Improper Control of Generation of Code (‘Code Injection’)?

Improper Control of Generation of Code (‘Code Injection’) (CWE-94) is a type of code injection vulnerability that occurs when the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

As defined by the MITRE Corporation under CWE-94, and classified by the OWASP Foundation under A05:2025 - Injection, Improper Control of Generation of Code (‘Code Injection’) is a critical security vulnerability that requires immediate attention.

Quick Summary

Improper Control of Generation of Code (‘Code Injection’) (CWE-94) is a type of code injection vulnerability that occurs when the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This vulnerability can lead to bypassing protection mechanisms, gaining privileges or assuming identity, executing unauthorized code or commands, and hiding activities.

Jump to: What is Improper Control of Generation of Code (‘Code Injection’)? · Quick Summary · Improper Control of Generation of Code (‘Code Injection’) Overview · How Improper Control of Generation of Code (‘Code Injection’) Works · Business Impact of Improper Control of Generation of Code (‘Code Injection’) · Improper Control of Generation of Code (‘Code Injection’) Attack Scenario · How to Detect Improper Control of Generation of Code (‘Code Injection’) · How to Fix Improper Control of Generation of Code (‘Code Injection’) · Framework-Specific Fixes for Improper Control of Generation of Code (‘Code Injection’) · How to Ask AI to Check Your Code for Improper Control of Generation of Code (‘Code Injection’) · Improper Control of Generation of Code (‘Code Injection’) Best Practices Checklist · Improper Control of Generation of Code (‘Code Injection’) FAQ · Vulnerabilities Related to Improper Control of Generation of Code (‘Code Injection’) · References · Scan Your Own Site

Improper Control of Generation of Code (‘Code Injection’) Overview

What: Improper Control of Generation of Code (‘Code Injection’) (CWE-94) is a type of code injection vulnerability that occurs when the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Why it matters: Improper Control of Generation of Code (‘Code Injection’) can lead to bypassing protection mechanisms, gaining privileges or assuming identity, executing unauthorized code or commands, and hiding activities. It is a critical security vulnerability that requires immediate attention.

Where it occurs: This vulnerability typically occurs in web applications, APIs, and services using external input to construct code segments.

Who is affected: Any organization that uses web applications, APIs, or services with externally-influenced input to construct code segments can be affected by this vulnerability.

Who is NOT affected: Applications that never construct paths/queries/commands from external input are not affected by this vulnerability.

How Improper Control of Generation of Code (‘Code Injection’) Works

Root Cause

The root cause of Improper Control of Generation of Code (‘Code Injection’) (CWE-94) is the failure to neutralize or incorrectly neutralizing special elements in externally-influenced input that could modify the syntax or behavior of the intended code segment.

Attack Flow

1. An attacker sends a request with malicious input to the web application.
2. The web application constructs all or part of a code segment using the malicious input.
3. The constructed code segment is executed, leading to unauthorized access or modifications.

Prerequisites to Exploit

• The web application uses externally-influenced input to construct code segments.
• The attacker has knowledge of the web application’s code structure and can craft malicious input that exploits the vulnerability.

Vulnerable Code

import os

path = request.form['path']
os.chdir(path)

This vulnerable code allows an attacker to change the current working directory using malicious input, leading to unauthorized access or modifications.

Secure Code

import os

path = request.form['path']

# Validate and sanitize the path
if not os.path.abspath(path).startswith(base_dir):
    raise ValueError('Invalid path')

os.chdir(path)

This secure code validates and sanitizes the input path before changing the current working directory, preventing unauthorized access or modifications.

Business Impact of Improper Control of Generation of Code (‘Code Injection’)

The business impacts of Improper Control of Generation of Code (‘Code Injection’) (CWE-94) include:

• Financial losses due to unauthorized access or modifications
• Reputational damage due to security breaches
• Compliance issues due to regulatory non-compliance

Improper Control of Generation of Code (‘Code Injection’) Attack Scenario

1. An attacker sends a request with malicious input to the web application.
2. The web application constructs all or part of a code segment using the malicious input.
3. The constructed code segment is executed, leading to unauthorized access or modifications.

How to Detect Improper Control of Generation of Code (‘Code Injection’)

Manual Testing

• Use fuzz testing techniques to send malicious input to the web application and observe its behavior.
• Use robustness testing techniques to test the web application’s ability to handle unexpected input.
• Use fault injection techniques to simulate errors in the web application and observe its behavior.

Automated Scanners (SAST / DAST)

• Use static analysis tools to identify potential vulnerabilities in the web application’s code.
• Use dynamic analysis tools to identify potential vulnerabilities in the web application’s runtime behavior.

PenScan Detection

PenScan’s scanner engines can detect Improper Control of Generation of Code (‘Code Injection’) by analyzing the web application’s code and runtime behavior.

False Positive Guidance

A finding on a dynamic-execution sink (eval, exec, a template-rendering call, etc.) that only ever receives a fixed, developer-written string with no external input concatenated into it is a false positive — the weakness requires attacker-influenced data to reach the sink.

How to Fix Improper Control of Generation of Code (‘Code Injection’)

• Refactor your program to avoid dynamically generating code.
• Run your code in a sandbox environment that enforces strict boundaries between the process and the operating system.
• Use input validation techniques to ensure that all user input is properly sanitized and validated.

Framework-Specific Fixes for Improper Control of Generation of Code (‘Code Injection’)

Java

import java.io.File;

String path = request.getParameter('path');

// Validate and sanitize the path
if (!new File(path).isAbsolute()) {
    throw new RuntimeException('Invalid path');
}

// Change the current working directory
System.setProperty("user.dir", path);

This secure code validates and sanitizes the input path before changing the current working directory, preventing unauthorized access or modifications.

Node.js

const fs = require('fs');

let path = request.body.path;

// Validate and sanitize the path
if (!fs.existsSync(path)) {
    throw new Error('Invalid path');
}

// Change the current working directory
process.chdir(path);

This secure code validates and sanitizes the input path before changing the current working directory, preventing unauthorized access or modifications.

Python/Django

import os

path = request.GET.get('path')

# Validate and sanitize the path
if not os.path.abspath(path).startswith(base_dir):
    raise ValueError('Invalid path')

os.chdir(path)

This secure code validates and sanitizes the input path before changing the current working directory, preventing unauthorized access or modifications.

PHP

$path = $_GET['path'];

// Validate and sanitize the path
if (!is_dir($path)) {
    throw new RuntimeException('Invalid path');
}

// Change the current working directory
chdir($path);

This secure code validates and sanitizes the input path before changing the current working directory, preventing unauthorized access or modifications.

How to Ask AI to Check Your Code for Improper Control of Generation of Code (‘Code Injection’)

To ask an AI coding assistant to review your code for potential CWE-94 Improper Control of Generation of Code (‘Code Injection’) vulnerabilities and rewrite it using input validation techniques:

Review the following Python/Django code block for potential CWE-94 Improper Control of Generation of Code ('Code Injection') vulnerabilities and rewrite it using input validation techniques:

import os

path = request.GET.get('path')

# Validate and sanitize the path
if not os.path.abspath(path).startswith(base_dir):
    raise ValueError('Invalid path')

os.chdir(path)

This code block can be reviewed by an AI coding assistant to identify potential CWE-94 Improper Control of Generation of Code (‘Code Injection’) vulnerabilities and rewritten using input validation techniques.

Improper Control of Generation of Code (‘Code Injection’) Best Practices Checklist

✅ Validate all user input. ✅ Sanitize any data that is used to construct code segments. ✅ Use a secure coding framework to ensure that your code is free from CWE-94 Improper Control of Generation of Code (‘Code Injection’) vulnerabilities.

Improper Control of Generation of Code (‘Code Injection’) FAQ

How is Improper Control of Generation of Code (‘Code Injection’) different from other code injection vulnerabilities?

Improper Control of Generation of Code (‘Code Injection’) occurs when the product constructs all or part of a code segment using externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

What are the common consequences of Improper Control of Generation of Code (‘Code Injection’)?

The common consequences of Improper Control of Generation of Code (‘Code Injection’) include bypassing protection mechanisms, gaining privileges or assuming identity, executing unauthorized code or commands, and hiding activities.

How can I detect Improper Control of Generation of Code (‘Code Injection’) in my application?

You can detect Improper Control of Generation of Code (‘Code Injection’) by using manual testing techniques such as fuzz testing, robustness testing, and fault injection, or by using automated scanners that interact with your product using large test suites.

What are the potential mitigations for Improper Control of Generation of Code (‘Code Injection’)?

The potential mitigations for Improper Control of Generation of Code (‘Code Injection’) include refactoring your program to avoid dynamically generating code, running your code in a sandbox environment that enforces strict boundaries between the process and the operating system, and using input validation techniques.

How can I prevent Improper Control of Generation of Code (‘Code Injection’) in my application?

You can prevent Improper Control of Generation of Code (‘Code Injection’) by following best practices such as validating all user input, sanitizing any data that is used to construct code segments, and using a secure coding framework.

What are the business impacts of Improper Control of Generation of Code (‘Code Injection’)?

The business impacts of Improper Control of Generation of Code (‘Code Injection’) include financial losses due to unauthorized access or modifications, reputational damage due to security breaches, and compliance issues due to regulatory non-compliance.

How can I fix Improper Control of Generation of Code (‘Code Injection’) in my application?

You can fix Improper Control of Generation of Code (‘Code Injection’) by following the potential mitigations mentioned earlier, such as refactoring your program or using input validation techniques.

Vulnerabilities Related to Improper Control of Generation of Code (‘Code Injection’)

References

• MITRE Corporation
• OWASP Foundation
• CAPEC
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Improper Control of Generation of Code (‘Code Injection’) and other risks before an attacker does.