Hello everyone. Today, we're going to
talk about command injection issues.
First off, we're going to talk about what
command injection is and why it's a vulnerability,
and then we're going to go over an example
and some Java API uses to watch out for,
and then we're going to talk
about strategies for mitigation.
After this lesson, you'll be able to
describe and discuss command injection issues,
as well as be able to formulate a plan to
prevent them from occurring. So, let's go.
Command injection happens when a Web application takes
some user controlled data and uses
that user controlled data as input into a command.
So, it becomes part of a command that is then
passed on to a shell or an OS command call.
A malicious attacker can manipulate
the user controlled data to then
run their own OS command.
Since the OS command calls through the web application
is done under the same privileges
as a web application process,
then the malicious attacker has
effectively gain those same privileges.
So, for example, if a Web application
is vulnerable to a command injection,
then through that vulnerability,
a malicious attacker can then create a
backdoor to eventually perform data exfiltration.
Now, here is a list of API usages
in Java that you need to watch out for,
and this is where you pay
extra attention in your Web applications.
This is because the use of these Java APIs has
a possibility of introducing
command injection vulnerabilities,
and it depends on how they are used.
So, I would highly encourage you to become
familiar with a set of API commands,
and how they are used normally,
and then think about how you could eventually
inject malicious user data into them.
Here's an example of
a vulnerability that could arise using
the runtime.getRuntime.exec Java API call.
Here, I'll note that the variable called
args is a user controlled parameter,
and using a shell redirection character like the pipe.
So, here's the character pipe.
The attacker can redirect the initial command,
and then call Netcat,
and to listen in on port 8080.
So in general, what you want to avoid
is allowing shell control flow
characters like pipe or
ampersand or greater than or less than character.
These are all called shell controlled flow characters.
You want to basically validate
your user controlled data before any further processing,
and again you want to use whitelisting
to basically give a set of commands that
are allowed to be run on
a constrain-to-string data to be only alphanumeric,
and also use API calls
that don't support command training.
For example, using process builder,
where as input the command name
is separate from its command arguments,
and you would do these if you have to use
user-controlled data as input into an OS command.
However, in general, you should avoid placing
user-controlled data into these command
calls that will eventually be processed by a shell.
In summary, we chatted about what command injection is,
and we talked about a particular example,
and then we talked about some strategies for
mitigating command injection issues.
Thanks for listening.