sc-cmdi

SC: Command Injection

Purpose

Detects OS command injection vulnerabilities where user-controlled input is passed to system shell commands, subprocess execution, or process spawning functions without proper sanitization. Distinguishes between full command injection (attacker controls the command) and argument injection (attacker controls arguments to a fixed command).

Activation

Called by sc-orchestrator during Phase 2. Runs against all detected languages.

Phase 1: Discovery

File Patterns to Search

**/*.py, **/*.js, **/*.ts, **/*.go, **/*.php, **/*.java, **/*.kt,
**/*.cs, **/*.rb, **/scripts/*, **/*exec*, **/*shell*, **/*command*,
**/*process*, **/*system*, **/*spawn*

Keyword Patterns to Search

# Python
"os.system(", "os.popen(", "subprocess.call(", "subprocess.run(",
"subprocess.Popen(", "subprocess.check_output(", "commands.getoutput(",
"shell=True"

# JavaScript/Node.js
"child_process.exec(", "child_process.execSync(",
"child_process.spawn(", "execFile(", "require('child_process')",
"shelljs", "execa"

# Go
"exec.Command(", "exec.CommandContext(", "os/exec"

# PHP
"exec(", "system(", "passthru(", "shell_exec(", "popen(",
"proc_open(", "pcntl_exec(", "backtick"

# Java
"Runtime.getRuntime().exec(", "ProcessBuilder(",
"new ProcessBuilder("

# C#
"Process.Start(", "ProcessStartInfo(",
"System.Diagnostics.Process"

# Ruby
"system(", "exec(", "IO.popen(", "`"

Data Flow Tracing

Sources: HTTP request parameters, file names from uploads, environment variables from user-controlled sources, database values originally from user input.

Sinks: All command execution functions listed above.

Phase 2: Verification

Command Injection vs Argument Injection

Command injection — attacker controls the full command or can inject shell operators:

# VULNERABLE: Full command injection
os.system(f"echo {user_input}")  # user_input = "; rm -rf /"

Argument injection — attacker controls arguments to a known-safe binary:

# VULNERABLE: Argument injection
subprocess.run(["git", "clone", user_url])  # user_url = "--upload-pack=evil"