Potential for OS command injection
Description
It is generally not recommended to call out to the operating system to execute commands. When the application is executing file system based commands, user input should never be used in constructing commands or command arguments. If possible, determine if a library can be used instead to provide the same functionality. Otherwise, consider hard coding both the command and arguments to be used, or at the very least restricting which arguments can be passed to the command execution function.
Examples
Insecure Code
c
system(user_input);Secure Code
c
system("ls -l");Remediation
Use a library or hard code the command and arguments instead of using the system function with user input
Rule Details
| Field | Value |
|---|---|
| ID | CODE-0615 |
| Category | Injection |
| Severity | HIGH |
| CWE | CWE-78 |
| Confidence | HIGH |
| Impact | HIGH |
| Likelihood | MEDIUM |
| Exploitability | EASY |
| Tags | os-command-injection, injection |
| OWASP | A1:2017-Injection, A03:2021-Injection |