CriticalA05:2025CWE-78Injection

OS Command Injection

Command injection occurs when an application passes unsafe user-supplied data to a system shell. An attacker can execute arbitrary operating system commands on the server with the privileges of the vulnerable application.

Overview

OS Command Injection (also known as shell injection) is a vulnerability that allows an attacker to execute arbitrary operating system commands on the server hosting an application. This typically occurs when an application passes user-controllable data to a system shell without proper sanitization. It is one of the most severe vulnerability classes because it can lead to full system compromise.

Types & Variants

Direct Command Injection

The attacker's input is directly included in a command that is executed by the system shell.

Blind Command Injection

The output of the executed command is not returned in the HTTP response. The attacker must use techniques like time delays or out-of-band channels to confirm exploitation.

Impact

Complete server compromise, data exfiltration, lateral movement, installation of malware or backdoors, denial of service.

Examples

Direct Injection via Ping

ping -c 1 8.8.8.8; cat /etc/passwd

Blind Injection with Time Delay

127.0.0.1 && sleep 10

Remediation

Avoid calling OS commands directly. Use language-specific APIs instead. If shell commands are unavoidable, use strict allowlists and never pass user input directly to shell functions.

Avoid calling OS commands from application code entirely

Use language-level APIs and libraries instead of shell commands

If OS commands are necessary, use strict input validation with allowlists

Never concatenate user input into command strings

Run the application with minimum required privileges

Implement application-level sandboxing and containerization