Is code injection possible in Java?

Question

nowadays you can read much about code injection, exploits, buffer-, stack- and heap-overflows etc. leading to inject and run code. I wonder what of this stuff is relevant for Java.

I know, there are no pointers in the Java language. But doesn't the JVM organize data in heaps and / or stacks? I know there is no eval function (like in PHP) so you cant easily use an input as Java-code. I am not so sure whats going on on bytecode level.

I think XSS is possible, for example in an Java EE application, when no inputs are filtered. But isn't this more a JavaScript injection, because the injected code runs in the browser and not in the JVM?

So which code injections are possible with java and which are not? And is this true for other Java platform languages, too?

Thanks in advance.

Pheasant

Answer 1

A java program itself is pretty much not vulnerable to code injection. However, all the native code that supports the app is vulnerable to all the different kinds of code injection - this includes the JVM and all native code parts in the app or its libraries.

Also, there are a few more things to consider:

Anything where java is used as a gateway to other systems is possible:

SQL Injection

XSS (which is in the end nothing more than JavaScript Injection)

If the java program is itself a interpreter/compiler of some kind, it might be possible to inject code into your interpreted language/compiled program (this includes using your program as a java compiler...)

And of course if you can get the java program to write a file to disk that contains code (be it native, java or something else) you might be able to get it executed by other means (which can be a different vulnerability in your app, the os or another app) - this is not direct code injection but quite similar in effect.

Operate

Answer 2

If the server application creates bytecode at runtime (for example with BCEL or Javassist), and if this creation can be influenced by user input, then a code injection is possible.

However, if you application uses no magic (which should be 99% of all applications), it will not be possible.

Annabal

Answer 3

There are a couple ways in which Java code could be injected into an application such as using the scripting API or dynamic JSP includes.

The code below allows a user to inject arbitrary Javascript into Java's script engine.

import javax.script.*;

public class Example1 {
    public static void main(String[] args) {
        try {
            ScriptEngineManager manager = new ScriptEngineManager();
            ScriptEngine engine = manager.getEngineByName("JavaScript");
            System.out.println(args[0]);
            engine.eval("print('"+ args[0] + "')");
        } catch(Exception e) {
            e.printStackTrace();
        }
    }
}

In this case, the attacker decides to inject code that creates a file on the file system.

hallo'); var fImport = new JavaImporter(java.io.File); with(fImport) { var f = new File('new'); f.createNewFile(); } //

check owasp website for more examples

Drusilla

Answer 4

You could write a web service that accepted a Java code snippet, wrapped it in a class/method declaration, saved it to disk, ran the compiler on it and then dynamically loaded and executed the result. So code injection is certainly possible.

But with typical Java implementations, it's perhaps not very efficient because of the relatively heavyweight compilation process (it might still be practical for some apps though).

Code injection is highly relevant with SQL because the "first guess" of many beginners is to use string concatenation to insert variables into a statement. But it rarely crops up as an idea amongst Java programmers. So that's the reason it isn't much of a concern.

If Java compilers become exposed as light-weight library services, then you'd have something much closer to the equivalent of eval and therefore it might start to become a relevant concern.

Knowlton

The remark about efficiency does not seem terribly relevant in this context, code injection does not necessarily need to be efficient. Most exploits do not require high performance... . The point is that not many apps do the "accept code, compile it, run it" thing, but those that do would be vulnerable. – Heikeheil

"If Java compilers become exposed as light-weight library services": well, they are already (check out javax.tools.JavaCompiler, java.sun.com/javase/6/docs/api/javax/tools/JavaCompiler.html). But again, for code injection to work, the app under attack needs to use JavaCompiler, which most fortunately don't. – Heikeheil

@Heikeheil - In the third paragraph I say "But it rarely crops up as an idea amongst Java programmers. So that's the reason it isn't much of a concern." So I already make the point you make in two of your comments. And in your comment about performance being irrelevant, I think you're confused about the problem - apps don't pass inputs to an interpreter/compiler in order to enable exploits. They do it typically to inject values via string concatenation. And they will very likely have limits on how slow or heavyweight this can be before they consider a simpler solution. – Knowlton

Answer 5

If it was possible, Java would already have been dead for long.

On the other hand, SQL injections are very easy to avoid by using PreparedStatement to store user-controlled input and XSS is also very easy to avoid by using <c:out/> for (re)displaying user-controlled input at the webpage.

Hewie

Answer 6

Unless you are doing weird things on the server (like dynamically generating code, etc), it is impossible to bo vunerable for code injection.

Although I can think of an (ugly) situation where the application dynamically creates a JSP based on user input. That JSP will be translated to Java code, which is being compiled to byte-code by the web container, and then executed. This could introduce an injection point. But generating JSP's dynamically normally doesn't make any sense.

Swop

Answer 7

You can't inject Java. But if you are not careful, people could inject Javascript (i.e. XSS as you mention) or SQL. There are heaps and stacks, but no way to get to them.

Y

Answer 8

You can't inject java, but all web applications are vulnerable to XSS if the input is not properly filtered. Also any application that interacts with a sql database can be vulnerable to SQL injection. To avoid this you will want to look into Parameterized Queries.

Copenhaver

Answer 9

It is certainly more difficult, if you compare it to interpreted languages. However, the JVM supports scripting languages like JavaScript, and one of the example above demonstrates injection when JavaScript is at play. The JVM also supports scripting with Groovy, which is the the Java scripting equivalent. So, if you know that this is what is happening behind the scenes, you can use something similar to this:

 Class scriptClass = new GroovyClassLoader().parseClass( new File( "test.groovy" ) ) ;

Of course, you will have to get test.groovy on the server somehow, which is another story. See this thread for more details: Calling a Groovy function from Java. Groovy compiles to byte code on the fly and it is automatically loaded into the JVM. I've seen enterprise applications written in Java expose a Scripting Web Console, where you could supply an entire Groovy file and execute it with the system still running ... with Admin privileges. Behind it uses the JVM's scripting capabilities. You could also use it with JavaScript. Here are the scripting languages supported by the JVM as of July, 2020:

• Java Kotlin Scala Groovy Clojure Fantom Ceylon Jython JRuby Frege Xtend Golo Concurnaas Yeti See this article for more details.

Bottom line, code injection in Java is not as easy as it is in other languages, especially interpreted ones, like JavaScript, Ruby, PHP, etc.

Sayette