Editing Code injection (section)

===Shell injection===
Shell injection (or command injection<ref>{{cite web|title= Command Injection|url=https://www.owasp.org/index.php/Command_Injection |access-date= 19 December 2013|archive-date= 20 December 2013|archive-url= https://web.archive.org/web/20131220043257/https://www.owasp.org/index.php/Command_Injection}}</ref>{{rs|date=March 2025}}) is named after [[UNIX shell script|UNIX]] shells but applies to most systems that allow software to programmatically execute a [[command line]]. Here is an example vulnerable [[tcsh]] script:
<syntaxhighlight lang="tcsh">
!/bin/tcshcheck arg outputs it matches if arg is one
if ($1 == 1) echo it matches
</syntaxhighlight>
If the above is stored in the executable file <code>./check</code>, the shell command <code>./check " 1 ) evil"</code> will attempt to execute the injected shell command <code>evil</code> instead of comparing the argument with the constant one. Here, the code under attack is the code that is trying to check the parameter, the very code that might have been trying to validate the parameter to defend against an attack.<ref>Douglas W. Jones, CS:3620 Notes, [http://www.cs.uiowa.edu/~jones/opsys/notes/04.shtml Lecture 4—Shell Scripts]. {{Webarchive|url=https://web.archive.org/web/20240924022340/http://homepage.divms.uiowa.edu/~jones/opsys/notes/04.shtml|date=24 September 2024}}, Spring 2018.</ref>

Any function that can be used to compose and run a shell command is a potential vehicle for launching a shell injection attack. Among these are [http://linux.die.net/man/3/system <code>system()</code>], [https://pkg.go.dev/os#StartProcess <code>StartProcess()</code>], and [http://msdn.microsoft.com/en-us/library/92699yzt.aspx <code>System.Diagnostics.Process.Start()</code>].

[[Client–server model|Client-server]] systems such as [[web browser]] interaction with [[web server]]s are potentially vulnerable to shell injection. Consider the following short PHP program that can run on a web server to run an external program called <code>funnytext</code> to replace a word the user sent with some other word.

<syntaxhighlight lang="php">
<?php
passthru("/bin/funnytext " . $_GET['USER_INPUT']);
</syntaxhighlight>

The <code>passthru</code> function in the above program composes a shell command that is then executed by the web server. Since part of the command it composes is taken from the [[URL redirection|URL]] provided by the web browser, this allows the [[URL]] to inject malicious shell commands. One can inject code into this program in several ways by exploiting the syntax of various shell features (this list is not exhaustive):<ref>{{Cite web |url=http://blackhat.life/Command_Injection |title=Command Injection - Black Hat Library |access-date=27 February 2015 |archive-url=https://archive.today/20150227081226/http://blackhat.life/Command_Injection |archive-date=27 February 2015 }}</ref>

{| class="wikitable"
|-
! Shell feature
! <code>USER_INPUT</code> value
! Resulting shell command
! Explanation
|-
| Sequential execution
| <code>; malicious_command</code>
| <code>/bin/funnytext ; malicious_command</code>
| Executes <code>funnytext</code>, then executes <code>malicious_command</code>.
|-
| [[pipeline (Unix)|Pipelines]]
| <code>&#124; malicious_command</code>
| <code>/bin/funnytext &#124; malicious_command</code>
| Sends the output of <code>funnytext</code> as input to <code>malicious_command</code>.
|-
| Command substitution
| <code>`malicious_command`</code>
| <code>/bin/funnytext `malicious_command`</code>
| Sends the output of <code>malicious_command</code> as arguments to <code>funnytext</code>.
|-
| Command substitution
| <code>$(malicious_command)</code>
| <code>/bin/funnytext $(malicious_command)</code>
| Sends the output of <code>malicious_command</code> as arguments to <code>funnytext</code>.
|-
| AND list
| <code>&& malicious_command</code>
| <code>/bin/funnytext && malicious_command</code>
| Executes <code>malicious_command</code> [[iff]] <code>funnytext</code> returns an exit status of 0 (success).
|-
| OR list
| <code>&#124;&#124; malicious_command</code>
| <code>/bin/funnytext &#124;&#124; malicious_command</code>
| Executes <code>malicious_command</code> [[iff]] <code>funnytext</code> returns a nonzero exit status (error).
|-
| Output redirection
| <code>&gt; ~/.bashrc</code>
| <code>/bin/funnytext &gt; ~/.bashrc</code>
| Overwrites the contents the <code>.bashrc</code> file with the output of <code>funnytext</code>.
|-
| Input redirection
| <code>&lt; ~/.bashrc</code>
| <code>/bin/funnytext &lt; ~/.bashrc</code>
| Sends the contents of the <code>.bashrc</code> file as input to <code>funnytext</code>.
|}

Some languages offer functions to properly escape or quote strings that are used to construct shell commands:
* [[PHP]]: <code>[http://www.php.net/manual/en/function.escapeshellarg.php escapeshellarg()]</code> and <code>[http://www.php.net/manual/en/function.escapeshellcmd.php escapeshellcmd()]</code>
* [[Python (programming language)|Python]]: <code>[https://docs.python.org/3/library/shlex.html#shlex.quote shlex.quote()]</code>
However, this still puts the burden on programmers to know/learn about these functions and to remember to make use of them every time they use shell commands. In addition to using these functions, validating or sanitizing the user input is also recommended.

A safer alternative is to use [[API]]s that execute external programs directly rather than through a shell, thus preventing the possibility of shell injection. However, these [[API]]s tend to not support various convenience features of shells and/or to be more cumbersome/verbose compared to concise shell syntax.