Config files : Code injection

Interpreting and executing data from an untrusted source during application execution allows to execute malicious code in the context of the application.

A code injection type of vulnerability is assumed when a developer mistakenly believes that only harmless instructions will come from the user. User instructions which not validated may cause danger.

The level of potential damage from such an attack depends on the user’s input validation performance and file protection mechanisms.

The Invoke-Expression cmdlet takes a string as an argument and returns the result of its execution, so an attacker should never be able to explicitly influence the argument of this cmdlet.

Client side code injection attacks take the first place in the “OWASP Top 10 2017” web application vulnerabilities ranking and the seventh place in the “OWASP Mobile Top 10 2014” ranking.