os-command-injection

OS Command Injection Detection

Overview

OS command injection is a server-side flaw in which an application builds an operating-system command that incorporates untrusted input and hands it to a shell, letting the attacker end the intended command and append their own. It sits wherever request data flows into a process invocation: a converter called on an uploaded file, a diagnostic tool run against a supplied host, a report generator, a scheduled maintenance script fed a stored value. The attacker is typically a remote user, often unauthenticated, who supplies shell metacharacters inside a parameter the developer assumed would be a filename, an identifier, or a menu choice. Because the injected command runs with the privileges of the application process, success means reading and writing every file that user can touch, harvesting credentials and cloud tokens, pivoting to internal systems, and planting persistence — this is the class with the least distance between a single unsafe line and full host compromise. This skill finds it by locating every process invocation that carries a dynamic string, checking each site in parallel, and merging the results into <output_dir>/os-command-injection-results.md.

What it is NOT

• Template injection (/websec:ssti): the attacker's payload is evaluated by a template engine inside the language runtime, not by a shell. Test: is the sink a render or compile call, or a process launch? Both can end in code execution; the sink and the fix differ.
• Unsafe deserialization (/websec:deserialization): execution comes from reconstructing an object graph, not from spawning a process. Test: is there an exec call on the path at all?
• Server-side request forgery (/websec:ssrf): the server is made to issue a network request. Test: is the sink an HTTP client, or a shell? A URL passed to a shelled-out curl is command injection; the same URL passed to an HTTP library is SSRF.
• Path traversal (/websec:path-traversal): a path parameter reaches a file read or write and nothing is executed. Test: does anything run, or is a file merely opened? If the traversal only selects which binary a launcher runs, note it here and say so.
• File upload (/websec:file-upload): storing an executable in a served directory is that class; passing an attacker-influenced filename into a shell command is this one. The two chain often — record the chain in Impact.
• Not a finding: a command whose every argument is a constant or a server-generated value; an argv-array exec with the shell disabled and validated arguments; a command string built from an enum the request only selects an index into; commands in build scripts, developer tooling, and test helpers that no request reaches.