Description
OS Command Execution, also known as Command Injection, is a severe vulnerability that allows attackers to execute arbitrary commands on the host operating system. Attackers exploit this vulnerability by injecting malicious commands through forms, cookies, or HTTP headers. These commands run with the privileges of the vulnerable application, leading to unauthorized access, data theft, and system compromise.
Recommendation
To prevent OS Command Execution attacks, developers should utilize language-specific APIs instead of executing shell commands directly. Input validation is crucial to filter out malicious characters. Implementing a positive security model, where only known safe characters are allowed, is an effective approach to mitigate this vulnerability.
References
Could your website be exposed too?
SmartScanner can check your website for OS Command Execution and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Blind OS Command Execution - Vulnerability
- WordPress 4.6 Blind OS Command Execution - CVE-2016-10033
- Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE - Vulnerability
- @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defst - Vulnerability
