Skip to main content

Remote command execution

Need​

Prevention of unauthorized remote command execution

Context​

  • Usage of Python 3 for scripting and software development
  • Usage of the os module for interacting with the operating system in Node.js
  • Usage of Django for building web applications

Description​

Non compliant code​

import os
from django.http import HttpResponse

def run_command(request):
    command = request.GET.get('command')
    os.system(command)
    return HttpResponse("Command executed")

In the above code, the function run_command(request) is vulnerable to remote command execution. This function takes a HTTP GET request and extracts the 'command' parameter from it. The value of this parameter is then passed directly to the os.system() function which runs the command in the shell of the operating system.

The vulnerability lies in the fact that there is no validation or sanitization of the 'command' parameter. This means that an attacker could craft a HTTP GET request with a 'command' parameter that contains malicious shell commands. When this request is processed by the run_command(request) function, the malicious commands would be executed on the server's operating system.

This could lead to a number of serious security issues, such as unauthorized access, data theft, data corruption, denial of service, or even complete takeover of the system.

Steps​

  • Validate the input: Ensure that the input provided by the user is valid and expected. This can be done by using a whitelist of acceptable inputs.
  • Sanitize the input: Remove or escape any special characters that could be used to modify the OS command. This can be done using a function that specifically handles this task.
  • Use parameterized commands: Instead of directly inserting user input into the command, use a method that allows you to insert parameters into the command. This ensures that the input is treated as a string and not part of the command itself.
  • Limit permissions: Run the application with the least privileges necessary. This can limit the damage that can be done if a command injection vulnerability is exploited.
  • Use a safer function: Instead of using os.system, which passes the command and its arguments to a shell, use a function like subprocess.run, which does not use a shell and is therefore less susceptible to command injection.

Compliant code​

import subprocess
from django.http import HttpResponse
from django.core.exceptions import ValidationError

def validate_command(command):
    # Define a list of safe commands
    safe_commands = ['ls', 'pwd', 'date']

    # Check if the command is in the list of safe commands
    if command not in safe_commands:
        raise ValidationError(f'Invalid command: {command}')

def run_command(request):
    command = request.GET.get('command')

    # Validate the command
    validate_command(command)

    # Run the command
    subprocess.run(command, shell=False)

    return HttpResponse("Command executed")

The updated code includes a function validate_command that checks if the command provided by the user is in a list of safe commands. If the command is not in the list, a ValidationError is raised. This is an example of input validation, where we ensure that the input provided by the user is valid and expected.

In the run_command function, we first get the command from the request. Then, we validate the command using the validate_command function. If the command is valid, we run the command using the subprocess.run function with shell=False. This ensures that the command is not run in a shell, making it less susceptible to command injection.

This code also follows the principle of least privilege by only allowing a specific set of commands to be run. This can limit the damage that can be done if a command injection vulnerability is exploited.

Please note that the list of safe commands is just an example. In a real-world application, you would need to define a list of commands that are safe for your specific use case.

References​

Last updated on