CWE-94: Improper Control of Generation of Code ('Code Injection')

Description:
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected languages: Interpreted
Affected technologies: AI/ML
Parent weaknesses: CWE-74, CWE-74, CWE-913

Consequences:
  - Access Control: Bypass Protection Mechanism
  - Access Control: Gain Privileges or Assume Identity
  - Integrity: Execute Unauthorized Code or Commands
  - Non-Repudiation: Hide Activities

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
  - [Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. 
                   Examples include the Unix chroot jail and AppArmor. In general, managed
  - [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. 
                   When pe
  - [Testing] Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.

Demonstrative examples:
This example attempts to write user messages to a message file and allow users to view them.
While the programmer intends for the MessageFile to only include data, an attacker can provide a message such as:
$MessageFile = "messages.out"; if ($_GET["action"] == "NewMessage") { $name = $_GET["name"]; $message = $_GET["message"]; $handle = fopen($MessageFile, "a+"); fwrite($handle, "<b>$name</b> says '$message'<hr>\n"); fclose($handle); echo "Message Saved!<p>\n"; } else if ($_GET["action"] == "ViewMessages") { include($MessageFile); }
name=h4x0r message=%3C?php%20system(%22/bin/ls%20-l%22);?%3E

edit-config.pl: This CGI script is used to modify settings in a configuration file.
The script intends to take the 'action' parameter and invoke one of a variety of functions based on the value of that parameter - config_file_add_key(), config_file_set_key(), or config_file_delete_key(). It could set up a conditional to invoke each function separately, but eval() is a powerful way of doing the same thing in fewer lines of code, especially when a large number of functions or variables are involved. Unfortunately, in this case, the attacker can provide other values in the action parameter, such as:
use CGI qw(:standard); 
                      sub config_file_add_key { 
                         my ($fname, $key, $arg) = @_; 
                            
                            # code to 

Real-world examples:
  - CVE-2023-29374: Math component in an LLM framework translates user input into a Python
			   expression that is input into the Python exec() method, allowing code
			   execution - one variant of a "prompt injection"
  - CVE-2024-5565: Python-based library uses an LLM prompt containing user input to
			   dynamically generate code that is then fed as input into the Python
			   exec() method, allowing code execution - one variant of
  - CVE-2024-4181: Framework for LLM applications allows eval injection via a crafted response from a hosting provider.
  - CVE-2022-2054: Python compiler uses eval() to execute malicious strings as Python code.
  - CVE-2021-22204: Chain: regex in EXIF processor code does not correctly determine where a string ends (CWE-625), enabling eval injection (CWE-95), as exploited in the wild per CISA KEV.