OS Command Injection

What Is Broken and Why

Command injection occurs when an application passes user-supplied data to a system shell without sanitization, effectively letting the attacker append their own commands. Applications that invoke OS utilities (ping, nslookup, file conversion tools, archive utilities) by constructing shell strings are particularly susceptible. The vulnerability grants attacker-level access equivalent to the web server process user, enabling file read/write, network pivoting, and privilege escalation.

Key Signals

• Application invokes OS utilities and reflects their output (ping results, DNS lookups, file listings)
• Parameters accepting hostnames, filenames, or search terms passed to shell commands
• Error messages referencing shell commands or paths (/bin/sh, cmd.exe)
• File download or conversion features that call system utilities
• Parameters containing IP addresses or hostnames processed server-side
• Dangerous functions in source: Runtime.exec(), os.system(), shell_exec(), proc_open(), subprocess.call()