Command Injection

Command injection happens when untrusted input is used to construct system command without necessary escaping that is later evaluate and executed by the operating system. An adversary exploits this vulnerability to execute arbitrary commands.

Remediation

Where possible avoid using untrusted input in building system commands.
Use a safe library that perform contextual escaping of the data and separates code from the data.

Metadata

Severity: critical
Slug: command-injection

CWEs

78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

OWASP

A03:2021: Injection

Available Labs

Open Java labs in SecDim Play for this vulnerability.

easy

Command Injection.java

Java Easy

medium

Opengraph.java.hth

Java Medium Battle New Signature

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.