Command Injection Analysis

Purpose

Teach defensive analysis of OS command injection and unsafe shell invocation: untrusted input alters the command line interpreted by a shell or exec API, yielding RCE on the application host.

When to Use / When Not to Use

Use when:

• Code uses os.system, subprocess with shell=True, exec/spawn with string commands, Runtime.exec, backticks, child_process.exec, CI hooks, image/ffmpeg wrappers, ping/traceroute utilities.
• After AXguard hits injection.* shell/exec rules.
• Agent/tool runners execute model-suggested shell commands (/axguard-agent adjacency).

Do not use when:

• Process APIs use fixed argv arrays with no shell and no user-controlled binary path (still review path traversal on filenames separately).
• Pure in-process eval of language code (different skill / injection.python-eval class — still injection, but not OS command).

Security Concepts

Shell metacharacters (|;$&\\n) change command **structure**. Argument arrays avoid the shell; they do not fix a user-controlled **executable path** or unsafe flags. shell=False` + argv is the default safe pattern when an external binary is required.

Threat Model

Attacker goals:

1. Execute arbitrary OS commands as the app user.
2. Read secrets, pivot laterally, install persistence.
3. Abuse privileged wrappers (sudoers, setuid helpers, container breakout via mounts).

Analysis Workflow

1. Find sinks: system, popen, subprocess.*, exec(, spawn(, Runtime.exec, ProcessBuilder with concatenated strings.
2. Determine if a shell is involved (shell=True, /bin/sh -c, string form of exec).
3. Trace attacker influence on command string, argv elements, env, or cwd.
4. Check whether “sanitization” is denylist-based (usually insufficient) vs allowlisted tokens.
5. Confirm whether the binary itself is fixed or user-selectable.
6. Assess runtime privileges (container root, cloud role, access to secrets mounts).
7. For AI agents: treat model/tool output as untrusted input to the same sinks.

Evidence Requirements

• Sink location and shell vs argv mode
• Source of taint into command/args
• Missing allowlist or unsafe concatenation
• Privilege/impact context of the process

False Positive Controls

• Hard-coded argv, no user influence
• Validated allowlist of subcommands/flags mapped server-side
• Library wrappers that only accept typed enums
• Test harnesses intentionally calling shells on fixtures

Remediation

1. Prefer native libraries over shelling out.
2. Use argv arrays; never shell=True with untrusted data.
3. Allowlist executables and arguments; reject metacharacters by refusing shell entirely.
4. Drop privileges; isolate in a locked-down worker/container.
5. For agents: require human approval / strict tool allowlists for shell tools.

Verification

Detect shell sinks → Convert to argv/allowlist → Re-run axguard → Confirm no string-built shell calls remain

Related Skills

• ssti-analysis, deserialization-security — alternate RCE classes
• path-traversal, file-upload-security — often chained into command tools
• security-triage, security-remediation

Framework Mapping

• CWE-78 (OS Command Injection), CWE-77 (Command Injection)
• OWASP Top 10 2021 A03:2021 Injection

References

• https://owasp.org/Top10/A03_2021-Injection/
• https://cwe.mitre.org/data/definitions/78.html
• https://cwe.mitre.org/data/definitions/77.html

Research Provenance

Primary sources:

• OWASP Top 10:2021 A03 (accessed 2026-09-15)
• CWE-78, CWE-77 (accessed 2026-09-15)

Secondary / internal:

• AXGuard rules/injection.json, /axguard-inject
• AwareXone Agentic-Bug-Hunter command-injection methodology (concepts only; not copied)

Datasets:

• UVID HF dataset — category linkage concepts only (MIT license metadata review 2026-09-15)