OS Command Injection
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OS command injection occurs when an application builds a shell command from user input, so metacharacters such as ;, |, &&, backticks, or $() let an attacker append their own commands. The injected commands run with the privileges of the application process, which typically means full compromise of the host. It is especially common in network appliances, routers, and admin panels that wrap system utilities such as ping, nslookup, or tar.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- A diagnostics page runs ping -c 4 <host>, and entering 8.8.8.8; cat /etc/shadow runs the second command too.
- A file conversion service passes the uploaded file name to a shell, so a file named x.png;id runs the injected command.
- A VPN appliance's web interface passes a request parameter into a system() call before authentication.
How to mitigate it
- Avoid calling the shell; use native library functions for the task instead of invoking external utilities.
- When an external program is unavoidable, call it with an argument array (execve-style) so no shell parses the input.
- Validate input against a strict allow-list, for example only an IP address or hostname format, and reject everything else.
- Run the process as a low-privilege account in a sandbox so a successful injection has limited reach.
Go deeper
Practice this topic
Test your knowledge of OS Command Injection with exam-style practice questions.