Threat Actors Exploiting OS Command Injection Flaws To Hack Systems, CISA Warns
- С сайта: Vulnerability(cybersecuritynews.com)
- Вернуться к списку новостей
С сайта: Vulnerability(cybersecuritynews.com)
Such hacking can result in serious security breaches, enabling attackers to compromise system integrity, commit information theft, and disrupt service.
Cybersecurity researchers at CISA warned that threat actors have been using OS command injection vulnerabilities to compromise systems.
OS Command Injection Vulnerabilities – CISA Warns
The CISA and FBI have issued a Secure by Design Alert in response to the operating system (OS) command injection vulnerabilities, a preventable yet persistent security flaw.
Recent high-profile attacks exploiting these vulnerabilities in network edge devices (CVE-2024-20399, CVE-2024-3400, CVE-2024-21887) have allowed unauthenticated remote code execution.
These flaws stem from inadequate validation and sanitization of user input when constructing OS commands.
The alert urges technology manufacturers’ CEOs and business leaders to task their technical teams with analyzing past occurrences and developing strategies to eliminate such vulnerabilities, highlighting the critical importance of secure-by-design practices in software development.
Secure-by-design products protect against common and dangerous vulnerabilities, including OS command injection flaws.
Despite being preventable, these vulnerabilities persist, as evidenced by recent additions to CISA’s KEV Catalog (CVE-2024-20399, CVE-2024-3400, CVE-2024-21887).
To mitigate risks, developers should use built-in library functions that separate commands from arguments, implement input parameterization, validate and sanitize user input, and limit user-controlled command parts.
Best practices include using specific functions like os.mkdir() in Python, over general-purpose commands and enforcing rules during code review to disallow risky command invocations.
These measures, implemented from the design phase onward, significantly reduce security risks and customer burden.
There are three key principles that CISA and FBI recommend manufacturers observe to guard against OS command injection exploits and other preventable malicious activities.
Through these principles, the security of a product can be upgraded while its drawbacks are reduced. Here below, we have mentioned those three key principles:-
CISA and FBI encourage software manufacturers to take the Secure by Design Pledge, committing to seven key goals, including reducing systemic vulnerabilities like OS command injection.
This initiative encourages industry-wide best practices and a cultural shift towards developing inherently secure products.
To prevent vulnerabilities, technical managers should use safer command-generating functions, review threat models, employ modern component libraries, conduct code reviews, and implement rigorous adversarial product testing throughout the development lifecycle.
The Secure by Design Alert series promotes these practices to eliminate entire vulnerability classes during product design and development phases.
#Cyber_Security #Cyber_Security_News #Network_Security #Vulnerability #cyber_security #cyber_security_news #Secure_by_Design #Vulnerability_Management
Оригинальная версия на сайте:
Threat Actors Exploiting OS Command Injection Flaws To Hack Systems, CISA Warns
Author: Tushar Subhra DuttaSuch hacking can result in serious security breaches, enabling attackers to compromise system integrity, commit information theft, and disrupt service.
Cybersecurity researchers at CISA warned that threat actors have been using OS command injection vulnerabilities to compromise systems.
OS Command Injection Vulnerabilities – CISA Warns
The CISA and FBI have issued a Secure by Design Alert in response to the operating system (OS) command injection vulnerabilities, a preventable yet persistent security flaw.
Recent high-profile attacks exploiting these vulnerabilities in network edge devices (CVE-2024-20399, CVE-2024-3400, CVE-2024-21887) have allowed unauthenticated remote code execution.
These flaws stem from inadequate validation and sanitization of user input when constructing OS commands.
The alert urges technology manufacturers’ CEOs and business leaders to task their technical teams with analyzing past occurrences and developing strategies to eliminate such vulnerabilities, highlighting the critical importance of secure-by-design practices in software development.
Secure-by-design products protect against common and dangerous vulnerabilities, including OS command injection flaws.
Despite being preventable, these vulnerabilities persist, as evidenced by recent additions to CISA’s KEV Catalog (CVE-2024-20399, CVE-2024-3400, CVE-2024-21887).
To mitigate risks, developers should use built-in library functions that separate commands from arguments, implement input parameterization, validate and sanitize user input, and limit user-controlled command parts.
Best practices include using specific functions like os.mkdir() in Python, over general-purpose commands and enforcing rules during code review to disallow risky command invocations.
These measures, implemented from the design phase onward, significantly reduce security risks and customer burden.
There are three key principles that CISA and FBI recommend manufacturers observe to guard against OS command injection exploits and other preventable malicious activities.
Through these principles, the security of a product can be upgraded while its drawbacks are reduced. Here below, we have mentioned those three key principles:-
- Principle 1: Take Ownership of Customer Security Outcomes
- Principle 2: Embrace Radical Transparency and Accountability
- Principle 3: Build Organizational Structure and Leadership to Achieve These Goals
CISA and FBI encourage software manufacturers to take the Secure by Design Pledge, committing to seven key goals, including reducing systemic vulnerabilities like OS command injection.
This initiative encourages industry-wide best practices and a cultural shift towards developing inherently secure products.
To prevent vulnerabilities, technical managers should use safer command-generating functions, review threat models, employ modern component libraries, conduct code reviews, and implement rigorous adversarial product testing throughout the development lifecycle.
The Secure by Design Alert series promotes these practices to eliminate entire vulnerability classes during product design and development phases.
#Cyber_Security #Cyber_Security_News #Network_Security #Vulnerability #cyber_security #cyber_security_news #Secure_by_Design #Vulnerability_Management
Оригинальная версия на сайте:
