OS command injection: when a text field talks to the server

The principle

Some features — converting a file, testing a network connection, generating a PDF — call an operating-system program behind the scenes, with a piece of visitor-supplied text inserted into the command sent.

If that text isn’t isolated properly, an attacker can slip in a special character (semicolon, ampersand, pipe) that ends the command the developer intended and starts their own right after it, in the same breath.

A concrete example

A “test connectivity” tool that runs ping followed by the supplied address behind the scenes. If a visitor enters 8.8.8.8 followed by a separator character and an identification command, and the site doesn’t isolate the input correctly, the server actually runs TWO commands in a row: the expected ping, then the attacker’s.

That second command can reveal which account the server runs as, list files, or much worse. Swap the harmless example for a download-and-execute command, and it’s full control of the machine.

Why it’s serious

Unlike SQL injection, which compromises a database, command injection compromises the SERVER itself directly: reading any system file, installing a persistent backdoor, pivoting into the rest of the company’s internal network.

OWASP classifies it under A03:2021 – Injection. It’s generally considered one of the most serious web flaws that exists, often scored at the top of the severity scale (CVSS), because the end result is outright server takeover.

How to protect yourself

Avoid at all costs calling a shell command interpreter with user text inserted directly into it. When calling an external program is genuinely necessary, use functions that pass arguments as a separate LIST, never a hand-concatenated string.

Concretely, in Python: subprocess.run(["ping", "-c", "1", ip], shell=False), never os.system("ping " + ip). Strictly validate the expected format upfront: an IP address must match an IP pattern, nothing else is accepted.

How SauronSec detects it

A unique, harmless token is inserted into a benign echo command. If that exact token comes back in the response WITHOUT the echo command itself appearing literally next to it — proof it was actually executed, not merely displayed as-is — that’s proof of real execution.

As a complement, a timing variant (a command that makes the server wait a precise duration proportional to the payload) confirms it beyond doubt, even in cases where nothing is visible in the response itself.