cwe-78-os-command-injection

To fix OS command injection vulnerabilities flagged by SAST in Java, replace insecure Runtime.getRuntime().exec() calls with validated ProcessBuilder usage. This remediates CWE-78 findings by enforcing input validation and secure process execution.

CWE-78 improper neutralization of OS commands occurs when Java applications execute OS commands using user-controlled input without validation. This vulnerability allows potential command injection attacks if external input is passed directly to command execution functions.

To use ProcessBuilder securely with external input, separate the command and its arguments into individual array elements rather than a single concatenated string. You must also implement strict input validation and sanitization before passing parameters to the ProcessBuilder.

Yes, Runtime.getRuntime().exec() is vulnerable to command injection when invoked with user-controlled input. SAST tools frequently flag this pattern, requiring remediation through secure ProcessBuilder alternatives and input validation to prevent attacks.

The best way to remediate CWE-78 command injection findings during a security review is to refactor insecure command execution code into secure ProcessBuilder implementations. This requires input validation and secure process execution to fully mitigate injection risks.