Skip to main content

Remote command execution

Need​

Prevention of unauthorized remote command execution

Context​

  • Usage of PHP for server-side scripting and web development
  • Usage of the /bin/cat command for displaying the contents of a file

Description​

Non compliant code​

<?php
    $userInput = $_GET['input'];
    $command = '/bin/cat '.$userInput;
    exec($command, $output);
    print_r($output);
?>

In the above code, we are directly taking user input from the URL parameter 'input' and appending it to our OS command '/bin/cat'. The exec() function is then used to execute this command and the output is printed.

This approach is vulnerable to Remote Command Execution, as a malicious user can manipulate the 'input' parameter to execute arbitrary commands on the host system. For example, an attacker could pass 'input=;rm -rf /' as a parameter, which would result in the execution of the 'rm -rf /' command, deleting all files on the system.

In PHP, the exec() function is used to execute an external program. The function takes a string argument which is the command to be executed, and optionally can take two additional arguments which can be used to get the output of the command and the return status. In our vulnerable code, we are not doing any kind of validation or sanitization on the user input which is directly passed to the exec() function. This is a serious security risk as it allows an attacker to run arbitrary commands on the server.

Steps​

  • Validate and sanitize user input: Ensure that the user input is what you expect. For example, if you expect a file name, ensure it does not contain any special characters or sequences that could be interpreted as a command.
  • Use built-in functions for file operations: Instead of using system commands, use built-in PHP functions for file operations. This reduces the risk of command injection.
  • Use parameterized functions: If you must use system commands, use functions that allow parameterization. This ensures that user input is always treated as data, not as part of the command.
  • Limit privileges: Run your PHP scripts with the least privileges necessary. This can limit the damage if an attacker manages to execute a command.
  • Implement a strong error handling strategy: Do not reveal any system information in error messages, and log errors for review.

Compliant code​

<?php
    $userInput = $_GET['input'];
    // Sanitize the user input
    $userInput = escapeshellarg($userInput);
    $command = '/bin/cat '.$userInput;
    exec($command, $output);
    print_r($output);
?>

The original code was vulnerable to remote command execution because it directly used user input in a system command without any validation or sanitization. This means that a malicious user could potentially manipulate the input to execute arbitrary commands on the system.

The fixed code mitigates this vulnerability by using the escapeshellarg() function to sanitize the user input before it is used in the system command. This function adds single quotes around a string and escapes any existing single quotes, allowing the string to be safely used as a shell argument. This means that even if a user tries to input a command, it will be treated as a single string argument to the cat command, rather than as part of the command itself.

However, it's important to note that while this fix mitigates the immediate vulnerability, using user input in system commands is generally risky and should be avoided if possible. Consider using built-in PHP functions for file operations instead. If you must use system commands, use parameterized functions to ensure that user input is always treated as data, not as part of the command.

Additionally, always run your PHP scripts with the least privileges necessary to limit potential damage if a vulnerability is exploited, and implement a strong error handling strategy that does not reveal system information in error messages.

References​

Last updated on