Code_Injection @ /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java

[SamHeadrickCx]

Checkmarx (SAST): Code_Injection
Security Issue: Read More about Code_Injection
Checkmarx Project: SamHeadrickCx/easybuggy4sb
Repository URL: https://github.com/SamHeadrickCx/easybuggy4sb
Branch: master
Scan ID: 94cbf8fd-fbe8-49c7-9c55-da0658f9cbfc

---

The application's parseJson method receives and dynamically executes user-controlled code using eval, at line 41 of /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java. This could enable an attacker to inject and run arbitrary code.

The attacker can inject the executed code via user input, jsonString, which is retrieved by the application in the process method, at line 21 of /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java.

Result 1:
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
Attack Vector:

    1. jsonString: /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java[21,91]
    2. jsonString: /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java[25,23]
    3. jsonString: /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java[32,35]
    4. jsonString: /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java[34,38]
    5. replaceAll: /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java[34,59]
    6. convertedJsonString: /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java[34,16]
    7. convertedJsonString: /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java[35,31]
    8. replaceAll: /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java[35,61]
    9. convertedJsonString: /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java[35,9]
    10. convertedJsonString: /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java[36,31]
    11. replaceAll: /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java[36,61]
    12. convertedJsonString: /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java[36,9]
    13. convertedJsonString: /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java[41,45]
    14. eval: /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/CodeInjectionController.java[41,27]
    Review result in Checkmarx One: Code_Injection