Command Injection

Also Known As

TL;DR

Explanation

Command injection occurs when user-controlled data is incorporated into a shell command without sanitisation. Attackers can append additional commands using shell metacharacters (;, |, &&) to run arbitrary programs with the web server's privileges — reading files, exfiltrating data, installing backdoors, or pivoting to other systems. Prevention: avoid shell functions entirely where possible; if unavoidable, use escapeshellarg() on every argument and escapeshellcmd() on the command.

How It's Exploited

Diagram

flowchart TD
    USER_CMD[User input: filename] --> CONCAT2[exec ls -la . filename .]
    CONCAT2 -->|input: . ; rm -rf /| EXEC2[Shell executes:<br/>ls -la .<br/>rm -rf /]
    EXEC2 --> DISASTER[Files deleted!]
    subgraph Fix
        ESCAPE[escapeshellarg wraps in quotes<br/>escapes all shell metacharacters]
        VALIDATE[Allowlist valid inputs<br/>reject anything else]
        AVOID[Use PHP functions directly<br/>avoid shell when possible]
    end
style CONCAT2 fill:#f85149,color:#fff
style DISASTER fill:#f85149,color:#fff
style ESCAPE fill:#238636,color:#fff

Common Misconception

Why It Matters

Common Mistakes

• Using shell_exec(), system(), or exec() with unsanitised user input even after escapeshellarg().
• Passing user-controlled arguments where escapeshellarg() is applied to the whole string but injection happens via argument structure.
• Using PHP functions that invoke a shell implicitly — preg_replace with /e modifier (removed in PHP 7), or older mail() with fifth argument.
• Not considering that command injection can occur in less obvious places like image processing CLI calls.

Code Examples

$file = $_POST['filename'];
exec("convert $file output.pdf");

// escapeshellarg wraps in single quotes and escapes embedded quotes
$file = escapeshellarg($_POST['filename']);
exec('convert ' . $file . ' output.pdf');

// Better: avoid shell entirely — use proc_open with an array
proc_open(['convert', $file, 'output.pdf'], $descriptors, $pipes);

References

• ↗ https://owasp.org/www-community/attacks/Command_Injection
• ↗ https://cwe.mitre.org/data/definitions/78.html

Tags

Related Terms