Dynamic code execution from user-controlled input

ID

vbnet.inject.code_injection

Severity

critical

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Inject

Language

VB.NET

Description

User-controlled input flows into dynamic code compilation or expression evaluation (CodeDomProvider.CompileAssemblyFromSource, DataTable.Compute or a computed DataColumn.Expression). An attacker who controls the compiled source or the evaluated expression can execute arbitrary code or logic, leading to code injection / remote code execution. Never build code or data-table expressions from untrusted input; use a fixed expression and pass user values as parameters, or strictly validate against an allow-list.

Rationale

User-controlled input flows into dynamic code compilation or expression evaluation (CodeDomProvider.CompileAssemblyFromSource, DataTable.Compute or a computed DataColumn.Expression). An attacker who controls the compiled source or the evaluated expression can execute arbitrary code or logic, leading to code injection / remote code execution. Never build code or data-table expressions from untrusted input; use a fixed expression and pass user values as parameters, or strictly validate against an allow-list.

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub CompileFromRequest(ByVal Request As HttpRequest)
    Dim src As String = Request.QueryString("code")
    Dim provider As CodeDomProvider = CodeDomProvider.CreateProvider("VisualBasic")
    Dim options As New CompilerParameters()
    ' VULNERABLE: Dynamic code execution from user-controlled input
    provider.CompileAssemblyFromSource(options, src)
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References