4. How to Prevent Command Injection?

[JTCyberTech]

Mastering Command Injection Part 4

How to Prevent Command Injection?

Preventing Command Injection Vulnerabilities

• Most effective way to prevent OS command injection vulnerabilities = never all out to OS commands from application layer code.

• Implement the required functionality using safer platform APIs.

• Use built in library function that only perform specific task you intended for them to perform and cannot be manipulated to perform other task.

• For example:

  • use mkdir() instead of system("mkdir /dir_name")

  • mkdir() can only create a directory.

  • system("mkdir /dir_name") can be manipulated to run any command.

• If it's absolutely necessary and required to perform OS commands using user supplied input. There are two solution:

  • Validate against a whitelist of permitted values.

  • For example: whitelist the 127.0.0.1 IP and your localhost IP. Other IP entered in will respond with an error message.

  • Validate that the input is as expected or valid input.

  • If you are expecting user to only input integers, then you should only allow integer to be enter in the system.

Key Takeaways

Primary defense/most effective is:

AVOID CALLING OS COMMANDS DIRECTLY.

INSTEAD YOU SHOULD USE THE BUILT IN LIBRARY FUNCTION THAT ONLY PERFORM THE SPECIFIC TASK THAT YOU INTENDED FOR THEM TO PERFORM.