What is a Command Injection?

The ubiquitous client-server architecture of the web provides hackers with a vast attack surface, leaving both the website and the server vulnerable to malicious exploitation. Security risks increase significantly if a website is configured to communicate with the host’s environment by supplying commands to the operating system directly.

To power certain functionality, websites may need to interact with the server’s shell environment, invoking shell commands or external scripts. If not implemented securely, this can allow an attacker to manipulate the communication variables and wreak havoc on the server by sending a well-crafted request to the operating system. This type of injection attack is commonly known as command injection.

Command injections are one of the most devastating types of cyber attacks hackers have in their toolkits. The ability to interact with the host’s operating system offers great potential for exploitation that spans far beyond the scope of the targeted website. Command injections can be so powerful that a hacker may even wipe the whole server from existence, leaving the victim to rebuild the whole infrastructure from scratch.

In this comprehensive guide to command injections, you will learn how attackers can circumvent the defenses that separate the website and server environments and how to minimize the risk of falling victim to this type of cyber attack.

Before we can delve into the insidious world of command injections, let’s review how operating system shells work and look at the way web applications can interact with them. This will help you understand what vehicle is used to deliver malicious requests to the server’s environment.

What is an Operating System Shell?

An operating system shell is a special type of program that provides users with an interface to interact with the operating system. Acting as an intermediary between the end user and the server’s operating system, a shell interprets commands supplied via the command line interface and ensures their execution in the context of the user’s environment.

Shells allow users and applications to send instructions to the operating system using a number of predefined commands. This includes internal shell commands that are part of the shell itself, external commands installed on the server as executable files, and specific aliases set up by the system administrator.

Operating system shells are commonly used to perform a wide variety of tasks, such as managing files and directories, installing and configuring software services, and setting up websites and web applications. Often, websites also need to call shell commands to manipulate files and carry out other tasks.

How do Websites Interact with the Server’s Operating System?

Websites and web applications, or more specifically, the functionality they provide, run in their own contained environment. This environment is fully separated from the critical areas of the server’s operating system. And while certain malicious techniques, such as directory traversal, allow attackers to access otherwise restricted areas of the victim’s server through the browser, there are several layers of defense that prohibit such behavior.

All code is usually confined within the website’s document root — a special directory on the server dedicated to website files. This, combined with the protective mechanism of file permissions, ensures that website operations are scoped to the website’s root directory and can not affect other areas of the system.

Website functions are also limited to the functionality provided by the programming language in use as opposed to the capabilities provided by the commands of the server’s operating system. To interact with the server’s environment, a website needs to use specific functions that will act as a bridge between its contained environment and the operating system. The system() and exec() functions are commonly used for that purpose.

Using fictions such as system() or exec(), a website can communicate with the server’s shell by executing shell commands or external scripts. However, if not properly secured, these functions can introduce serious security risks, making the website and the underlying system vulnerable to command injections.

What is a Command Injection?

A command injection allows attackers to execute arbitrary code on the server’s operating system by injecting shell commands through an HTTP request to the vulnerable website. The attack is possible if a website relies on shell commands to enable certain functionality and passes user-supplied data to the operating system as part of the instructions without input validation and sanitization.

Command injection attacks occur when a malicious actor is able to inject additional commands into the shell, disguising malicious code as part of a legitimate request. This allows the attacker to access and modify sensitive information, install malware, or perform other harmful actions against the server.

How do Command Injections Work?

To perform a command injection, an attacker uses special characters, such as “;”, “|”, and “&&”, to append malicious commands to the request’s parameters. Once the string is passed to the server, those special characters are interpreted by the system’s shell, forcing it to turn the supplied instructions into a series of separate requests. This way, the hacker’s malicious request gets executed as an isolated instruction, seemingly unrelated to the main task passed for execution by the vulnerable website.

On top of that, hackers can replace a legitimate shell command used by a script with malicious code that has been saved on the server in a file that has the same name as the original command. Typically, a shell environment defines the $PATH variable, which is used to specify a list of sources for external commands for the shell to search in. By modifying this variable, attackers can force malicious programs to run on the server.

An Example of Command injection

To perform a command injection attack, hackers target security flaws in the implementation of functions used to pass instructions to the server’s shell. This functionality can be required to create and remove files, among other things.

For example, let’s imagine that a website allows users to upload images and convert them into another format. The program saves the uploaded image, converts it, and then removes the original image.

Issues arise if the program relies on unsanitized user input to determine the name of the image to remove afterward. A hacker can easily append another shell command to the text string containing the filename, which will be executed by the operating system, resulting in a successful command injection attack.

In the example below, where imagename is the name of the image to be removed, a hacker can append additional commands using “&&“, which will separate the string into two parts. The first part represents a real filename, which will not raise any suspicions, so the shell will execute the second part of the instructions as well.

The “rm -rf /home/images/converted” instruction has the potential to remove all converted images that were previously saved by the program if the system user which the shell accepted the request from has sufficient permissions for this operation. This is why file permissions are one of the most important server-side security mechanisms that, if configured correctly, can provide a layer of defense against command injections and other types of cyber attacks.

Of course, this is an overly simplified example, and such a vulnerable program is unlikely to exist on any website. However, the logic behind it applies to modern command injection attacks. All it takes is finding a weak implementation of a function that relies on passing commands to the system shell.

Command injection and Code Injection: What’s the Difference?

Command injections are often confused with code injections, which is another dangerous type of application-level attack. While both belong to the same attack group, there are some significant differences between the two.

Code injection is a general term that refers to any type of application-level attack where a hacker is able to inject malicious code into a website or web application, usually by exploiting insufficient input validation or other types of vulnerabilities. Code injection is a whole group of injection attacks that includes cross-site scripting (XSS), file inclusion attacks, and SQL injections, among others.

Command injection is an elevated form of code injection. Rather than performing harmful actions against the code interpreter and exploiting the functionality of the victim’s website, an attacker targets the server’s operating system, performing unintended actions against the system’s shell. Command injection attacks allow hackers to break out of the victim’s website’s contained environment, significantly raising the scope of the damage they can cause.

The destructive potential command injections carry is what makes them the most perilous type of injection-style attacks. This is why it is crucial to know how to detect and mitigate command injection vulnerabilities on your website before hackers have the opportunity to use them to their advantage and wreak havoc on critical business assets.

How to Detect Command Injection Vulnerabilities?

WordPress core maintains a robust security framework that effectively protects websites against command injections and other types of injection attacks. However, the extensive customization options the website-building platform offers leave room for these vulnerabilities to exist on WordPress websites. Even reputable WordPress plugins and themes may contain security flaws that can expose websites to a vast array of malicious attacks.

SolidWP offers weekly WordPress vulnerability reports that allow you to promptly identify and patch newly disclosed security flaws in WordPress plugins and themes, including code and command injection vulnerabilities. Simply refer to the newest vulnerability report to determine if any security weaknesses have been recently discovered in the plugins and themes you use on your WordPress website, and check if a security patch has been released.

Solid Security Pro streamlines and automates vulnerability management, eliminating the need for manual effort. With its comprehensive vulnerability scanning capabilities, Solid Security Pro proactively identifies and alerts you to any security flaws discovered on your WordPress website and automatically installs security updates whenever a patch is available.

How to Defend Your WordPress Site Against Command Injection?

Vulnerable plugins and themes make one of the primary attack vectors hackers use to gain unauthorized access to WordPress websites to steal sensitive information, install malware, and launch network attacks. While following secure coding practices is the responsibility of plugin and theme developers, WordPress website owners must implement security measures to reduce the risk of becoming a victim of code and command injection attacks. A multifaceted approach to WordPress security is necessary to effectively manage all security risks.

Perform Regular Software Updates

Ensuring that your WordPress website is updated regularly is vital to prevent potential cyber-attacks. Timely software updates ensure that new security patches are installed on your website as soon as they are released. Rapid vulnerability patching leaves no room for attackers to identify and exploit any security weaknesses on your WordPress website.

With Solid Security Pro, new versions of software, including WordPress core, plugins, and themes, are automatically installed once they are made available to the WordPress community. The Version Management feature and advanced vulnerability scanning keep track of all updates for you, ensuring that your website remains up-to-date with the latest security fixes to eliminate the risk of successful command injection attacks.

If you manage multiple WordPress sites, Solid Central offers a comprehensive solution for one-click updates, advanced uptime monitoring, and remote website backups across all websites, all from a single dashboard.

Configure Secure File Permissions

Secure file permissions are an essential component of keeping your WordPress website protected against a wide variety of injection attacks. Command injection and code injection attacks involve a hacker exploiting a vulnerability in a website’s code to execute malicious code and are often possible due to insecure file permissions.

If the principle of least privilege is not enforced, attackers can gain access to data they should not be able to access, such as a script that runs with elevated privileges. Secure file permissions act as an additional layer of defense against command injection attacks, negating attackers’ efforts to exploit discovered vulnerabilities.

It is not always clear, however, how to configure file permissions securely, as it largely depends on the hosting environment the website runs in. This is why Solid Security Pro offers advanced file permissions checks to help ensure that the correct permissions are in place.

Install a Web Application Firewall

Firewalls serve as the first line of defense against a wide range of injection attacks, including both code and command injections. A web application firewall (WAF) acts as a guard for your website, scanning all incoming HTTP requests and filtering out those that match known malicious patterns, thereby preventing them from reaching the web server and inflicting damage on it.

The robust brute force protection and bot management solutions Solid Security Pro offers can prevent malicious bots and harmful web traffic from ever reaching your WordPress website. Bolstered by the addition of passkey-powered multi-factor authentication featuring biometric logins, this comprehensive security suite provides a multifaceted approach to WordPress website security.

Protect Your Website Against Command injections With Solid Security Pro

Command injection is one of the most powerful and destructive types of cyber attacks. Found at the very top of every injection vulnerability risk rating scale, command injections continue to target websites and web applications, even with the wide variety of mitigations in place enforced by modern web servers.

By exploiting security weaknesses in a website through command injection, attackers gain the ability to execute arbitrary commands against the host’s operating system. This level of access extends far beyond compromising the targeted website, opening up a vast array of possibilities for exploitation and control over the entire system.

Defending a website against command injections and other cyber attacks is a challenging task. In today’s threat landscape, relying on a single layer of defense is no longer sufficient to ensure the security of your online presence. That is why Solid Security Pro and Solid Backups are dedicated to making robust website security easily accessible to all WordPress website owners, providing you with the necessary tools to protect your business online.