Command Injection

Impact of Command Injection Attacks

• Unauthorized access to sensitive data
• System compromise
• Data manipulation or destruction
• Privilege escalation
• Use of the compromised system for further attacks

Common Command Injection Attack Vectors

• Unsanitized user input in system commands
• Use of shell_exec, exec, system, or similar functions with user input
• Improper handling of special characters in user input
• Lack of input validation and sanitization
• Use of outdated or vulnerable libraries and frameworks

• Validate and sanitize all user inputs
• Use parameterized queries or prepared statements
• Implement the principle of least privilege
• Use a whitelist of allowed characters and commands
• Avoid using system commands with user input whenever possible
• Implement proper error handling to avoid information disclosure
• Use Web Application Firewalls (WAF) to filter malicious requests
• Regularly update and patch all software and dependencies
• Conduct regular security audits and penetration testing
• Educate developers about secure coding practices and common command injection vulnerabilities

• Basic Command Injection

  If userInput is '8.8.8.8 && cat /etc/passwd', it will execute both commands.

  ping userInput

• Command Injection in PHP

  If filename is 'secret.txt; rm -rf /', it will display the file content and then attempt to delete all files.

  <?php system('cat ' . $_GET['filename']); ?>

• Command Injection in Python

  If user_input is '$(rm -rf /)', it will attempt to delete all files.

  import os
  os.system('echo ' + user_input)

• Command Injection in Node.js

  If userInput is '8.8.8.8 && cat /etc/passwd', it will execute both commands.

  const { exec } = require('child_process');
  exec('ping ' + userInput, (error, stdout, stderr) => {
    console.log(stdout);
  });