1. Executive Summary & Scope
Command Injection occurs when an application executes host operating system commands using system shells (`exec`, `system`, `passthru`, `shell_exec`, `popen`) and concatenates untrusted user input directly into the command string. Attackers append shell metacharacters (`;`, `&`, `|`, `` ` ``, `$()`) to execute arbitrary host commands.
Standard Classification
OWASP Standard: OWASP Top 10 • Mapping: CWE-78 • Target Architecture: Public Web Systems & APIs
2. Threat Model & Attack Vectors
Attackers exploit a network diagnostic or PDF generation feature to execute reverse shells, dump environment variables, install rootkits, and establish persistent access on the host server.
3. Code Analysis & Remediation Playbook
Vulnerable Implementation Pattern
// VULNERABLE: Concatenating IP address directly into system shell
$targetHost = $_POST['host'];
// Attacker input: "8.8.8.8; cat /etc/passwd"
$output = shell_exec("ping -c 3 " . $targetHost);
echo "
$output";
Hardened Defense-in-Depth Implementation
// REMEDIATED: Avoid shell execution entirely, or use argument arrays without shell interpreter
$targetHost = filter_var($_POST['host'], FILTER_VALIDATE_IP);
if (!$targetHost) {
http_response_code(400);
die("Invalid IP address");
}
// Option A: Use proc_open with bypass_shell = true and argument array
$process = proc_open(
['/bin/ping', '-c', '3', $targetHost],
[
0 => ['pipe', 'r'],
1 => ['pipe', 'w'],
2 => ['pipe', 'w']
],
$pipes,
null,
null,
['bypass_shell' => true]
);
$stdout = stream_get_contents($pipes[1]);
fclose($pipes[1]);
proc_close($process);
4. Audit Verification Checklist & Pass Criteria
| Verification Phase | Audit Test Description | Mandatory Passing Criteria |
|---|---|---|
| Metacharacter Injection Testing | Submit payloads containing `;`, `&&`, `|`, `$(whoami)`, `` `id` ``. | Characters are either rejected by strict input validator or passed as literal strings without shell interpretation. |
| Whitelisting Audit | Verify that input parameters match strict regex (e.g. `/^[a-zA-Z0-9_\-\.]+$/`). | Invalid characters trigger immediate validation rejection before execution. |
| Container & User Isolation | Verify application worker runs as unprivileged user with restricted filesystem rights. | Worker cannot execute `/bin/sh` or modify system binaries even under hypothetical injection. |
Advertisement
WE
WebOTG Application Security Directorate
Senior Security Auditor
WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.