Definition
Command Injection is a security vulnerability where an attacker can execute arbitrary commands on a host's operating system through a vulnerable application. This happens when user input is improperly sanitized and passed to a system shell.How It Works
- 1User input is received by the application.
- 2The input is concatenated into a command string that will be executed by the system shell.
- 3If the input is not properly sanitized, the attacker can append malicious commands.
- 4The system shell executes both the intended command and the injected command.
Key Characteristics
- Exploits system shell command execution.
- Occurs due to improper input validation.
- Can be blind (no direct output) or visible (output visible to attacker).
- Often involves chaining operators like
&&,||,|, and;.
Comparison
| Feature | Command Injection | SQL Injection |
|---|---|---|
| Target | OS Commands | Database Queries |
| Common Language | Shell Commands | SQL |
| Potential Impact | System Control | Data Access/Modification |
| Example Vulnerability | CVE-2014-6271 | CVE-2014-0160 |
Real-World Example
CVE-2014-6271, known as Shellshock, is a notorious example of command injection. It allowed attackers to execute arbitrary commands on servers using vulnerable versions of Bash, a popular Unix shell.Detection & Prevention
- Detection: Use tools like Burp Suite, OWASP ZAP, or nuclei to scan for vulnerabilities. Implement logging to detect unusual command execution.
- Prevention: Validate and sanitize all user inputs. Use parameterized queries and avoid using system shell commands when possible.
Common Misconceptions
- Command Injection is not the same as SQL Injection; they target different layers.
- Not all command injections provide immediate visible results; blind injections require indirect observation of effects.
- Using HTTPS does not protect against command injection; it only secures data in transit.