Intro to Command Injections
What command injection is
A Command Injection vulnerability allows attackers to execute arbitrary OS commands directly on the back-end server. If a web application passes user-controlled input into a system command without sanitization, an attacker can inject a malicious payload to subvert the intended command and run their own. This can lead to full network compromise.
Injection vulnerabilities (OWASP context)
Injection is ranked #3 in OWASP’s Top 10 Web App Risks due to high impact and prevalence. Injection occurs when user-controlled input is misinterpreted as part of a query or code being executed, subverting the intended outcome to one useful to the attacker.
Common injection types:
| Injection | Description |
|---|---|
| OS Command Injection | User input directly used as part of an OS command |
| Code Injection | User input inside a function that evaluates code |
| SQL Injection | User input directly used as part of an SQL query |
| XSS / HTML Injection | Exact user input displayed on a web page |
Other classes include LDAP, NoSQL, HTTP Header, XPath, IMAP, ORM, and more. New web technologies introduce new injection classes.
OS command injection
All major web languages provide functions to execute system commands. These may be used for installing plugins, running applications, or other server-side tasks — but when user input is passed to them unsanitized, command injection is possible.
PHP
PHP functions that execute system commands: exec, system, shell_exec, passthru, popen.
Vulnerable example:
<?php
if (isset($_GET['filename'])) {
system("touch /tmp/" . $_GET['filename'] . ".pdf");
}
?>
The filename GET parameter is used directly in touch without sanitization, allowing arbitrary command injection.
NodeJS
NodeJS equivalents: child_process.exec, child_process.spawn.
Vulnerable example:
app.get("/createfile", function(req, res){
child_process.exec(`touch /tmp/${req.query.filename}.txt`);
})
The filename parameter goes unsanitized into a shell command. The same injection methods apply across both examples.
Command injection is not unique to web applications — binaries and thick clients that pass unsanitized user input to system command functions are equally vulnerable.