commons-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Parag Joshi <>
Subject [IO] Query on Veracode issue
Date Wed, 10 Feb 2016 12:00:53 GMT

I am using Apache Commons IO v2.4 (commons-io-2.4.jar) in one of my
projects. My organization uses Veracode to scan the deliveries of my
project. Veracode scans the projects for vulnerability issues and flags the
flaws if the code and/or third-party libraries used in the project are
vulnerable for some external attacks.

During the recent scan the Veracode system flagged an issue in

Below are the details:

*CWE ID:* 78

*Name:* Improper Neutralization of Special Elements used in an OS Command
('OS Command Injection')

*Module:* commons-io-2.4.jar

*Source:* *Line#* 535

*Attack Vector: *java.lang.Runtime.exec

*Description:* This call to java.lang.Runtime.exec() contains a command
injection flaw. The argument to the function is constructed using
user-supplied input. If an attacker is allowed to specify all or part of
the command, it may be possible to execute commands on the server with the
privileges of the executing process. The level of exposure depends on the
effectiveness of input validation routines, if any. The first argument to
exec() contains tainted data from the variable cmdAttribs. The tainted data
originated from earlier calls to java.lang.string.!operator_javanewinit,!operator_javanewinit,,,,, and

*Remediation:* Validate all user-supplied input to ensure that it conforms
to the expected format, using centralized data validation routines when
possible. When using black lists, be sure that the sanitizing routine
performs a sufficient number of iterations to remove all instances of
disallowed characters. Most APIs that execute system commands also have a
"safe" version of the method that takes an array of strings as input rather
than a single string, which protects against some forms of command

Now, my organization needs an assessment report for the above issue from
the author of the third-party library which in this case it is Apache. Can
you please provide me the assessment report for above issue? Is this a
known issue? And is it safe to use commons-io-2.4.jar keeping in mind the
above issue?

Thanks in advanced,
Parag Joshi

  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message