STIGQter STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must protect from command injection.

DISA Rule

SV-222604r508029_rule

Vulnerability Number

V-222604

Group Title

SRG-APP-000251

Rule Version

APSC-DV-002510

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Modify the application so as to escape/sanitize special character input or configure the system to protect against command injection attacks based on application architecture.

Check Contents

Review the application documentation and the system configuration settings.

Interview the application administrator for details regarding security assessment including automated code review and vulnerability scans conducted to test for command injection.

Review the scan results from the entire application.

Verify scan configuration is set to check for command injection vulnerabilities.

If results indicate vulnerability, verify a subsequent scan has been run to ensure the issue has been remediated.

Manual test procedures are available on the OWASP website. Procedures may need to be modified to suit application architecture.

https://www.owasp.org/index.php/Testing_for_Command_Injection_%28OTG-INPVAL-013%29

If testing results are not provided demonstrating the vulnerability does not exist, or if the application representative cannot demonstrate how actions are taken to identify and protect from command injection vulnerabilities, this is a finding.

Vulnerability Number

V-222604

Documentable

False

Rule Version

APSC-DV-002510

Severity Override Guidance

Review the application documentation and the system configuration settings.

Interview the application administrator for details regarding security assessment including automated code review and vulnerability scans conducted to test for command injection.

Review the scan results from the entire application.

Verify scan configuration is set to check for command injection vulnerabilities.

If results indicate vulnerability, verify a subsequent scan has been run to ensure the issue has been remediated.

Manual test procedures are available on the OWASP website. Procedures may need to be modified to suit application architecture.

https://www.owasp.org/index.php/Testing_for_Command_Injection_%28OTG-INPVAL-013%29

If testing results are not provided demonstrating the vulnerability does not exist, or if the application representative cannot demonstrate how actions are taken to identify and protect from command injection vulnerabilities, this is a finding.

Check Content Reference

M

Target Key

4093

Comments