Blind Command Injection

Summary #

Netsparker identified a Blind Command Injection, which occurs when input data is interpreted as an operating system command.

It is a highly critical issue and should be addressed as soon as possible.

In this case, command injection was not obvious, but the different response times from the page based on the injection test allowed Netsparker to identify and confirm the command injection.

Impact #

An attacker can execute arbitrary commands on the system.

Actions To Take #

See the remedy for solution.
If possible, do not invoke system commands from the application.
Find all instances of similar code and make the code changes outlined in the remedy section.

Remediation #

Before invoking system commands within an application, consider using an API, which allows you to separate commands and parameters. This can avoid many of the problems associated with command execution. See the external references for some examples. If this is not possible, whitelist all input and encode it in accordance with the underlying subsystem. (e.g. if it is Windows, then you need to escape from cmd.exe control characters)

Required Skills for Successful Exploitation #

This is an easy issue to exploit, requiring little skill or knowledge. Most knowledgeable attackers can gain remote access over such a system within minutes.

Classifications #

PCI v3.1-6.5.1, PCI v3.2-6.5.1, CAPEC-88, CWE-78, HIPAA-78, ISO27001-A.14.2.5, WASC-31, OWASP 2013-A1, OWASP 2017-A1 , CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Netsparker Security Insights #

Helpful Use Cases #