hunting-os-command-injection

Hunting OS command injection: when input crosses into a shell

Command injection happens when untrusted input reaches a process-spawning API in a way that lets a shell interpret it. A shell treats characters like the semicolon, the pipe, the ampersand, backticks, and dollar parentheses as syntax, so an input that carries them can chain, substitute, or replace the intended command. The single fact that decides whether the class exists is whether a shell is in the loop: a call that composes a string and hands it to a system shell is injectable, while a direct exec that passes a fixed program and a separate argument vector, with no shell, is not, because the arguments are delivered as data. You find command injection by locating every spawn, deciding whether it goes through a shell, and tracing whether untrusted input reaches the command portion of a shell-interpreted call.

When to use

• Code runs an external command built from, or including, request or stored input.
• A spawn API is called in shell mode, or with a single composed string rather than an argument vector.
• Input influences the environment, the working directory, or the PATH of a spawned process.

Scope check

Test command injection only against systems you own or are authorized to assess, on non-production hosts, because a confirmed case runs commands on the server. Prove the class with an inert, side-effect-free command (an echo or a fixed delay) rather than anything destructive, and stay within the authorized host. If you can't name the authorization, stop.

The loop

1. Establish whether a shell is in the loop first. For each spawn, determine whether it invokes a shell (a system-style call, a shell-mode flag, or a single composed command string) or is a direct exec with a fixed program and a separate argument vector. This is the false-positive killer: a shell-less exec does not interpret metacharacters, so untrusted arguments there are not command injection, even though they may be argument injection, a separate concern. Name the spawn mode before judging the input.