hunting-command-argument-and-flag-injection

Hunting command argument and flag injection: when a value becomes an option

Argument injection lives in the safe-looking case: a program is spawned without a shell, as a fixed binary with a separate argument vector, so there is no metacharacter interpretation and command injection does not apply. The bug is that the target program parses its own arguments, and an attacker-controlled value placed in the vector can be read as an option rather than as data. A value that begins with a dash becomes a flag; a value inserted where the program has not yet seen the options-terminator can turn on a behavior the caller never intended, writing to a file, reading one, executing an embedded command, changing an output or a protocol, or contacting a network host. Because there is no shell, defenses aimed at metacharacters do nothing. You find it by locating shell-less spawns whose argument vector includes untrusted values and asking whether the target can parse those values as options.

When to use

• Code spawns a fixed program with an argument vector (no shell) that includes untrusted input.
• The target program accepts options that read or write files, run commands, or change its destination.
• Input can start with a dash, or is inserted before a fixed set of trailing operands.

Scope check

Test argument injection only against systems you own or are authorized to assess, on non-production hosts, because a confirmed case makes a real tool take an unintended action. Prove the class with an inert option whose effect is observable but harmless, and stay within the authorized host. If you can't name the authorization, stop.

The loop

1. Establish that input can occupy an option slot first. For each shell-less spawn, determine whether an untrusted value can start with a dash, or be positioned in the vector before the program has seen an options terminator, so the target parses it as an option rather than an operand. This is the false-positive killer: a value pinned after a -- terminator, or in a fixed operand position the program treats as data, cannot become a flag. Confirm the value can reach an option-parsed slot before going on.