command-injection

Command Injection Detection

When to Use

Audit any package that wraps CLI tools, runs build commands, processes files via external programs, or interfaces with git/ffmpeg/imagemagick/pandoc/etc.

CVSS is typically CRITICAL 9.8 for confirmed RCE.

Key Distinctions

Command Injection vs Argument Injection

• Command injection: Attacker breaks out of the intended command entirely (; rm -rf /)
• Argument injection: Attacker adds flags to the intended command (--upload-pack=malicious)
• Both are reportable. Command injection is CRITICAL, argument injection is HIGH.

Shell vs No-Shell Execution

• Shell execution (exec, system, os.popen): Command string passed to shell interpreter. Metacharacters (;, |, &&, backticks, $()) are interpreted. DANGEROUS.
• Direct execution (execFile, spawn without shell, subprocess with list args): Arguments passed directly to the program. No shell interpretation. SAFER but argument injection may still work.

Process

Step 1: Find Shell Execution Sinks

# JavaScript/TypeScript — look for child_process usage
grep -rn "child_process" .
grep -rn "\.exec\('" .
grep -rn "\.execSync\(" .
grep -rn "spawn.*shell.*true" .
grep -rn "shelljs" .

# Python
grep -rn "os\.system\|os\.popen" .
grep -rn "subprocess.*shell.*True" .
grep -rn "commands\.getoutput\|commands\.getstatusoutput" .

# Go
grep -rn 'exec\.Command.*"bash"\|exec\.Command.*"sh"' .

# Ruby
grep -rn "system(\|%x{" . --include="*.rb"
grep -rn "IO\.popen\|Open3" .

# PHP
grep -rn "system(\|passthru(\|shell_exec(\|popen(" .
grep -rn "proc_open\|pcntl_exec" .

Step 2: Trace User Input to Sink

For each sink:

1. What command string is constructed?
2. Is any part from user input (HTTP params, filenames, config values)?
3. Is the user input interpolated into a shell string or passed as an argument array?

Step 3: Check Sanitization

grep -rn "escapeshellarg\|escapeshellcmd\|shlex\.quote\|shellescape" .
grep -rn "sanitize\|escape\|clean\|validate" .