Skip to content

Remote Command Execution

Remote Command Execution

Description

Command injection is an attack in which the goal is execution of arbitrary commands on the Android operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data ( forms, cookies, HTTP headers etc.) to the system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.

Recommendation

To mitigate the command injection vulnerability, here are some recommendations:

  • Whenever possible, avoid constructing system commands from user input.
  • Use parameterized queries to pass parameters to a query or command string in a secure manner.
  • Use input validation to ensure user-supplied data is sanitized and contains only expected values.

Below are code examples where we use parametrized queries to execute system commands rather than raw concatenation.

val cmd = listOf("ls", "-al", "/path/to/directory")
val pb = ProcessBuilder(cmd)
val process = pb.start()

ProcessResult result = await Process.run(
      "ls",
      ['-al', '/path/to/directory'],
      includeParentEnvironment: false,
      environment: {});

Standards

  • OWASP_MASVS_L1:
    • MSTG_PLATFORM_2
  • OWASP_MASVS_L2:
    • MSTG_PLATFORM_2
  • CWE_TOP_25:
    • CWE_20
    • CWE_78
  • GDPR:
    • ART_5
    • ART_32
  • PCI_STANDARDS:
    • REQ_6_2
    • REQ_6_3
    • REQ_11_3
  • OWASP_MASVS_v2_1:
    • MASVS_CODE_4
  • SOC2_CONTROLS:
    • CC_2_1
    • CC_3_4
    • CC_4_1
    • CC_7_1
    • CC_7_2
    • CC_7_4
    • CC_7_5