Command Injection

web security

Definition

Command Injection (CWE-78)

A command injection vulnerability occurs when a server passes unsanitised input into an operating-system command that runs through a shell. Because the shell interprets metacharacters such as ; (command separator) and # (inline comment), attacker input can append arbitrary commands and obtain remote code execution (RCE) on the server.

<?php
system("ping -c 2 " . $_GET["ip"] . " -i 1");
?>

Request GET /ping.php?ip=8.8.8.8; cat /etc/passwd # produces the command

ping -c 2 8.8.8.8; cat /etc/passwd # -i 1

so the shell runs ping …, then cat /etc/passwd, then ignores the trailing -i 1.

Root Cause

Obs

The root cause is the same as for every web injection: mixing code and data — here, shell code and user data — into one string that a shell then parses.