/command-injection

name: command-injection
description: "Detect OS command injection via shell execution sinks where user-controlled input reaches system commands without proper sanitization."
metadata:
  filePattern:
    - "**/*.js"
    - "**/*.ts"
    - "**/*.py"
    - "**/*.go"
    - "**/*.rb"
    - "**/*.php"
  bashPattern:
    - "semgrep.*cmdi"
    - "grep.*(exec|spawn|system|popen)"
  priority: 90

Command Injection Detection

When to Use

Audit any package that wraps CLI tools, runs build commands, processes files via external programs, or interfaces with git/ffmpeg/imagemagick/pandoc/etc.

CVSS is typically CRITICAL 9.8 for confirmed RCE.

Key Distinctions

Command Injection vs Argument Injection

• **Command injection**: Attacker breaks out of the intended command entirely (`; rm -rf /`)
• **Argument injection**: Attacker adds flags to the intended command (`--upload-pack=malicious`)
• Both are reportable. Command injection is CRITICAL, argument injection is HIGH.

Shell vs No-Shell Execution

• **Shell execution** (exec, system, os.popen): Command string passed to shell interpreter. Metacharacters (`;`, `|`, `&&`, backticks, `$()`) are interpreted. DANGEROUS.
• **Direct execution** (execFile, spawn without shell, subprocess with list args): Arguments passed directly to the program. No shell interpretation. SAFER but argument injection may still work.

Process

Step 1: Find Shell Execution Sinks

# JavaScript/TypeScript — look for child_process usage
grep -rn "child_process" .
grep -rn "\.exec\('" .
grep -rn "\.execSync\(" .
grep -rn "spawn.*shell.*true" .
grep -rn "shelljs" .

# Python
grep -rn "os\.system\|os\.popen" .
grep -rn "subprocess.*shell.*True" .
grep -rn "commands\.getoutput\|commands\.getstatusoutput" .

# Go
grep -rn 'exec\.Command.*"bash"\|exec\.Command.*"sh"' .

# Ruby
grep -rn "system(\|%x{" . --include="*.rb"
grep -rn "IO\.popen\|Open3" .

# PHP
grep -rn "system(\|passthru(\|shell_exec(\|popen(" .
grep -rn "proc_open\|pcntl_exec" .

Step 2: Trace User Input to Sink

For each sink: 1. What command string is constructed? 2. Is any part from user input (HTTP params, filenames, config values)? 3. Is the user input interpolated into a shell string or passed as an argument array?

Step 3: Check Sanitization

grep -rn "escapeshellarg\|escapeshellcmd\|shlex\.quote\|shellescape" .
grep -rn "sanitize\|escape\|clean\|validate" .

Verify sanitization is:

• Applied to ALL user-controlled parts (not just some)
• Using the right function (escapeshellarg vs escapeshellcmd)
• Not bypassable (blocklists are almost always bypassable)

Step 4: Check for Argument Injection

Even with execFile/spawn (no shell), check for:

• `--flag` injection: user input starts with `-` or `--`
• Git-specific: `--upload-pack`, `-c core.fsmonitor`, `--config`
• Arguments that accept commands: `--exec`, `--filter`, `--diff-filter`
• Double-dash (`--`) separator missing before user-controlled args

Common Vulnerable Patterns

Pattern 1: String Interpolation in Shell Execution

// VULNERABLE — shell interprets metacharacters
const cp = require('child_process');
cp.exec(`convert ${inputFile} ${outputFile}`);
// Exploit: inputFile = "; id; #"

Pattern 2: Filename-Based Injection

cp.exec(`file "${filename}"`);
// Exploit: filename = '$(id).txt' or filename = '"; id; #"'

Pattern 3: Git Argument Injection

// Even without shell, git interprets dangerous flags
cp.execFile('git', ['clone', userUrl, '--config', 'core.fsmonitor=id']);

Pattern 4: Environment Variable Injection

cp.exec(command, { env: { ...process.env, USER_INPUT: untrusted } });
// If command references $USER_INPUT or uses env vars unsafely

Pattern 5: Newline Injection

cp.execFile('program', ['--option=' + userInput]);
// Exploit: userInput = "value\n--dangerous-flag"

Grep Patterns by Vulnerability Type

Direct Shell Injection

grep -rn "exec\(.*\+" .        # String concatenation in exec
grep -rn "exec\(.*\$\{" .      # Template literal in exec
grep -rn "exec\(.*%" .         # Format string in exec (Python)

Argument Injection

grep -rn "execFile\|spawn" .
# Then check if user input is in the args array without -- separator

CVSS Guidance

• Unauthenticated RCE: CRITICAL 9.8
• Authenticated RCE (low-priv): HIGH 8.8
• Argument injection (limited impact): HIGH 7.5-8.1
• Requires specific config/setup: HIGH 7.2 (AC:H)

References

• [Sinks](references/sinks.md) — Shell execution sinks by language
• [False Positive Indicators](references/false-positive-indicators.md) — When this isn't exploitable
• [PoC Skeleton](references/poc-skeleton.md) — Command injection PoC template