Command Injection
Command injection is when an attacker injects shell metacharacters into a system command the program constructs, achieving arbitrary command execution.
Purpose
To understand command injection caused by concatenating system commands and its defenses; a common vulnerability in programs that invoke a shell.
Mechanism
The program concatenates via system("cmd " + input); an attacker enters ;rm -rf / so the shell executes an extra command. Defenses: avoid the shell, parameterized exec, input validation and escaping.
Use cases
- Shell command security
- System call auditing
- Command concatenation defense