OS Command Injection Defense Cheat Sheet - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T14:34:06Z

Point to the official site

Thunder-Son: Migration to GitHub

2019-02-14T13:11:00Z

Migration to GitHub

Show changes

Dominique RIGHETTO: Replace PRE tag by Syntax highliting tag

2017-11-24T20:41:07Z

Replace PRE tag by Syntax highliting tag

Dominique RIGHETTO: Enhance information about Java's Runtime.exec

2017-11-17T22:58:09Z

Enhance information about Java's Runtime.exec

Katyanton at 20:03, 17 November 2017

2017-11-17T20:03:21Z

Dominique RIGHETTO: Add "Authors and Primary Editors" section

2017-11-17T09:47:51Z

Add "Authors and Primary Editors" section

Dominique RIGHETTO: Add note about the Java's Runtile.exec behavior from article "Command_Injection"

2017-11-17T09:34:49Z

Add note about the Java's Runtile.exec behavior from article "Command_Injection"

Katyanton at 21:03, 16 November 2017

2017-11-16T21:03:49Z

Jmanico: rename

2017-11-13T18:21:55Z

rename

New page

__NOTOC__
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |
Last revision (08/09/16): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

== Introduction ==

Command injection (or OS Command Injection) is a type of injection where the software, that constructs a system command using externally influenced input, does not correctly neutralizes the input from special elements that can modify the initially intended command.

For example, if the supplied value is:
<pre>
calc
</pre>
when typed in a Windows command prompt, the application “Calculator” is displayed.

However, if the supplied value has been tempered with, and now it is:
<pre>
calc & echo “test”
</pre>
when execute, it changes the meaning of the initial intended value. Now, both the “Calculator” application and the value “test” are displayed.
[[File:Comand-Injection.png|center|thumb]]

The problem is exacerbated if the compromised process does not follow the principle of least privilege principle and attacker-controlled commands end up running with special system privileges that increases the amount of damage.

== Primary Defenses ==

=== Defense Option 1: Avoid calling OS commands directly ===
The primary defense is to avoid calling OS commands directly. Built-in library functions are a very good alternative to OS Commands, and they cannot be manipulated to perform tasks other than those it is intended to do.

For example use “mkdir()” instead of system(“mkdir /dir_name”).

If there are available libraries or APIs for the language you used, this is the preferred method.

=== Defense option 2: Escape values added to OS commands specific to each OS ===

<b>TODO</b>
* For examples, see escapeshellarg() or escapeshellcmd() in PHP.

=== Defense option 3: Parametrization in conjunction with Input Validation ===

If it is considered unavoidable the call to a system command incorporated with user-supplied, the following two layers of defense should be used within software in order to prevent attacks
# '''Parametrization''' - If available, use structured mechanisms that automatically enforce the separation between data and command. These mechanisms can help to provide the relevant quoting, encoding.
# '''Input validation''' - the values for commands and the relevant arguments should be both validated. There are different degrees of validation for the actual command and its arguments:
#* When it comes to the '''commands''' used, these must be validated against a whitelist of allowed commands.
#* In regards to the '''arguments''' used for these commands, they should be validated using the following options:
#** Positive or “whitelist” input validation - where are the arguments allowed explicitly defined
#** White list Regular Expression - where is explicitly defined a whitelist of good characters allowed and the maximum length of the string. Ensure that metacharacters like & | ; $ > < ` \ ! and white-spaces are not part of the Regular Expression. For example, the following regular expression only allows lowercase letters and numbers, and does not contain metacharacters. The length is also being limited to 3-10 characters:
<pre>
^[a-z0-9]{3,10}$
</pre>

== Additional Defenses ==

=== Least privilege ===
On top of primary defences, parameterizations and input validation, we also recommend adopting all of these additional defenses in order to provide defense in depth.

These additional defenses are:
*Applications should run using the lowest privileges that are required to accomplish the necessary tasks.
*If possible, create isolated accounts with limited privileges that are only used for a single task.

== Code examples ==

=== C/C++ ===
Use function from exec() family ( execl(), execve(), etc., instead of system().

The exec family of functions does not use a full shell interpreter, so it is not vulnerable to command-injection attacks.

=== Java ===
In Java, use ProcessBuilder and the command must be separated from its arguments.

'''''Incorrect Usage'''''<pre>
ProcessBuilder b = new ProcessBuilder("C:\DoStuff.exe -arg1 -arg2");
</pre>
In this example, the command together with the arguments are passed as a one string, making easy to manipulate that expression and inject malicious strings.

'''''Correct Usage'''''

Here is an example that starts a process with a modified working directory. The command and each of the arguments are passed separately. This make it easy to validated each term and reduces the risk to insert malicious strings.

<pre>
ProcessBuilder pb = new ProcessBuilder("TrustedCmd", "TrustedArg1", "TrustedArg2");
Map<String, String> env = pb.environment();

pb.directory(new File("TrustedDir"));

Process p = pb.start();
</pre>

=== PHP ===
In PHP use escapeshellarg() or escapeshellcmd() rather than exec(), system(), passthru().

== Related articles ==
'''Description of Command Injection Vulnerability'''
* [[Command Injection|OWASP Command Injection]]

'''How to Avoid Vulnerabilities'''
* C Coding: [https://www.securecoding.cert.org/confluence/pages/viewpage.action?pageId=2130132 Do not call system()]
'''How to Review Code'''
* OWASP - [[Reviewing Code for OS Injection]]

'''How to Test'''
* [[OWASP Testing Guide]] article on [[Testing for Command Injection]]

'''External References'''
* [https://cwe.mitre.org/data/definitions/77.html CWE Entry 77 on Command Injection]

== Other Cheatsheets ==

{{Cheatsheet_Navigation_Body}}

|}

[[Category:Cheatsheets]]

← Older revision		Revision as of 14:34, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.md OS Command Injection Defense Cheat Sheet] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html OS Command Injection Defense Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 11: / Line 11: @@
 For example, if the supplied value is:
-<pre>
+<syntaxhighlight lang="shell">
   calc
-</pre>
+</syntaxhighlight>
 when typed in a Windows command prompt, the application “Calculator” is displayed.
 However, if the supplied value has been tempered with, and now it is:
-<pre>
+<syntaxhighlight lang="shell">
 calc & echo “test”
-</pre>
+</syntaxhighlight>
 when execute, it changes the meaning of the initial intended value. Now, both the “Calculator” application and the value “test”  are displayed.
 [[File:Comand-Injection.png|center|thumb]]
@@ Line 75: / Line 75: @@
 ''Code to test the note above:''
-<pre>
+<syntaxhighlight lang="java">
 String[] specialChars = new String[]{"&", "&&", "|", "||"};
 String payload = "cmd /c whoami";
@@ Line 97: / Line 97: @@
 System.out.printf("OUT   :\n%s\n", IOUtils.toString(p.getInputStream(), "utf-8"));
 System.out.printf("ERROR :\n%s\n", IOUtils.toString(p.getErrorStream(), "utf-8"));
-</pre>
+</syntaxhighlight>
 ''Result of the test:''
@@ Line 148: / Line 148: @@
 Here is an example that starts a process with a modified working directory. The command and each of the arguments are passed separately. This make it easy to validated each term and reduces the risk to insert malicious strings.
-<pre>
+<syntaxhighlight lang="java">
 ProcessBuilder pb = new ProcessBuilder("TrustedCmd", "TrustedArg1", "TrustedArg2");
@@ Line 156: / Line 156: @@
 Process p = pb.start();
-</pre>
+</syntaxhighlight>
 === .Net ===
 In .Net use System.Diagnostics.Process.Start to call underlying OS functions.
-<pre>
+<syntaxhighlight lang="C#">
 System.Diagnostics.Process process = new System.Diagnostics.Process();
@@ Line 174: / Line 174: @@
 process.Start();
-</pre>
+</syntaxhighlight>
 === PHP ===

← Older revision		Revision as of 22:58, 17 November 2017
Line 70:		Line 70:
	''Note about the Java's Runtime.exec method behavior:''		''Note about the Java's Runtime.exec method behavior:''

−	There are many sites that will tell you that Java's Runtime.exec is exactly the same as C's system function. This is not true. Both allow you to invoke a new program/process. However, C's system function passes its arguments to the shell (/bin/sh) to be parsed, whereas Runtime.exec tries to split the string into an array of words, then executes the first word in the array with the rest of the words as parameters. Runtime.exec does NOT try to invoke the shell at any point. The key difference is that much of the functionality provided by the shell that could be used for mischief (chaining commands using "&", "&&", "\|", "\|\|", etc, redirecting input and output) would simply end up as a parameter being passed to the first command, and likely causing a syntax error, or being thrown out as an invalid parameter.	+	There are many sites that will tell you that Java's Runtime.exec is exactly the same as C's system function. This is not true. Both allow you to invoke a new program/process. However, C's system function passes its arguments to the shell (/bin/sh) to be parsed, whereas Runtime.exec tries to split the string into an array of words, then executes the first word in the array with the rest of the words as parameters. Runtime.exec does NOT try to invoke the shell at any point and do not support shell metacharacters. The key difference is that much of the functionality provided by the shell that could be used for mischief (chaining commands using "&", "&&", "\|", "\|\|", etc, redirecting input and output) would simply end up as a parameter being passed to the first command, and likely causing a syntax error, or being thrown out as an invalid parameter.

← Older revision		Revision as of 20:03, 17 November 2017
Line 63:		Line 63:

	== Code examples ==		== Code examples ==
−
−	~~=== C/C++ ===~~
−	~~Use function from exec() family ( execl(), execve(), etc., instead of system().~~
−
−	~~The exec family of functions does not use a full shell interpreter, so it is not vulnerable to command-injection attacks.~~

	=== Java ===		=== Java ===

@@ Line 198: / Line 198: @@
 '''External References'''
 * [https://cwe.mitre.org/data/definitions/77.html CWE Entry 77 on Command Injection]
 == Other Cheatsheets ==

@@ Line 71: / Line 71: @@
 === Java ===
 In Java,  use ProcessBuilder and the command must be separated from its arguments.
 '''''Incorrect Usage'''''<pre>

@@ Line 3: / Line 3: @@
 {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
-| valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
+| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |
 Last revision (08/09/16): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
@@ Line 83: / Line 83: @@
 <pre>
 ProcessBuilder pb = new ProcessBuilder("TrustedCmd", "TrustedArg1", "TrustedArg2");
 Map<String, String> env = pb.environment();
@@ Line 88: / Line 89: @@
 Process p = pb.start();
 </pre>