Command Injection

ELI5 — The Vibe Check

Command injection is like SQL injection but worse — instead of attacking your database, the hacker injects shell commands that run on your actual server. If your code runs user input in a terminal command without sanitizing, an attacker could run rm -rf / on your production server.

Real Talk

Command injection occurs when user-controlled input is passed unsanitized to a shell command. Attackers can execute arbitrary OS commands with the application's privileges. Prevention involves avoiding shell execution with user input, using APIs with argument lists instead of shell strings, and strict input validation.

Show Me The Code

// ❌ Vulnerable: user input goes into shell command
import { exec } from 'child_process';
exec(`ping ${userInput}`); // if userInput = '8.8.8.8; rm -rf /', you're done

// ✅ Safe: use argument arrays, not shell strings
import { execFile } from 'child_process';
execFile('ping', ['-c', '4', userInput], callback);

When You'll Hear This

"The image resizer was vulnerable to command injection via the filename." / "Never pass user input directly to exec()."