Command Injection.

Command injection (OS command injection) occurs when an application builds a system command by concatenating untrusted input and hands the result to a shell. Metacharacters such as ;, &, |, $(), or backticks let the attacker chain additional commands that run with the privileges of the application process. Outcomes include arbitrary file reads and writes, lateral movement, reverse shells, and complete server takeover. It sits in the OWASP Top 10 under "Injection" (A03:2021) and is catalogued as CWE-78.

The root cause is the shell metacharacter interpreter, not the input itself, so the defining split is between calling a shell (system(), os.system, Runtime.exec("sh -c ..."), backticks) and calling the target binary directly with an argument vector (execve, subprocess.run([...], shell=False), ProcessBuilder). Argument-array APIs pass each token as a literal, so metacharacters never reach a parser. A related variant, argument injection, abuses a program's own flags (e.g. smuggling --output or -o ProxyCommand into git, curl, or ssh) even when no shell is invoked.

Real-world impact is severe on network edge devices. CVE-2024-3400 (CVSS 10.0) was an unauthenticated OS command injection in the GlobalProtect feature of Palo Alto Networks PAN-OS, exploited as a zero-day from April 2024 by the actor Volexity tracks as UTA0218 to plant reverse shells and exfiltrate firewall configs. CVE-2024-21887 in Ivanti Connect Secure, chained with the auth-bypass CVE-2023-46805, gave unauthenticated command execution and was mass-exploited in early 2024. The 2014 Shellshock bug (CVE-2014-6271) let attackers inject commands through crafted environment variables parsed by Bash, reachable via CGI, DHCP, and SSH.

Defences: avoid the shell entirely via argument-array APIs; strictly allow-list expected values; drop dangerous flags and metacharacters; run services as least-privileged users inside sandboxes/containers; and apply egress filtering so a foothold cannot phone home.

flowchart TD
  A[User input: hostname] --> B{Built into command}
  B -->|"os.system('ping ' + host)"| C[Shell interprets metacharacters]
  C --> D["host = 127.0.0.1; cat /etc/shadow"]
  D --> E[Attacker command runs as app user]
  E --> F[Reverse shell / data exfiltration / takeover]
  B -->|"subprocess.run(['ping', host], shell=False)"| G[Arg passed as literal token]
  G --> H[No shell parsing - injection neutralised]
  style F fill:#c0392b,color:#fff
  style H fill:#27ae60,color:#fff