Command Injection
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Command injection is the general weakness of building a command for any interpreter from user input without neutralizing characters that change the command's meaning. OS command injection (CWE-78) is the most familiar child, but the same flaw appears with other command processors, such as mail or LDAP utilities, scripting hosts, or device command line interfaces. The defence is the same in every case: keep data and command structure separate.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- An application passes a user-supplied recipient into a mail utility's command line, letting extra options read or write files.
- A network device's web interface forwards a parameter into its internal command line interface, where a newline starts a new privileged command.
- A Git-based feature passes a branch name beginning with -- that the git binary interprets as an option.
How to mitigate it
- Use APIs that take structured arguments rather than building command strings.
- Validate inputs against strict allow-lists, and use a -- separator so values cannot be read as options.
- Escape input for the specific command processor only as a last resort, using a well-tested library.
- Run command-executing components with least privilege and log the commands they execute.
Go deeper
Practice this topic
Test your knowledge of Command Injection with exam-style practice questions.