Command injection and remote code execution

Definitions follow OWASP and the CWE entries above.

An application calls an operating system program to do part of its work: resolve a host name, convert a file, send a ping. If it builds the command by joining a fixed program name with a value from the request and hands the result to a shell, the shell interprets everything in it.

An attacker supplies a value that contains a command separator followed by a command of their own. The shell runs both, with the application's privileges. OWASP's example appends a second command to a file name, and the server prints the contents of a file the user was never meant to see.

Code injection happens when input reaches a function that evaluates code: an eval call, a template engine that runs expressions, or deserialisation that rebuilds objects with behaviour. The attacker writes in the application's own language instead of the shell's.

Remote code execution is the result rather than the technique. It can come from command injection, code injection, an unsafe file upload or a flaw in a library. Once it exists, the attacker can read secrets, change data and use the server to reach others.

An upload form that accepts any file and stores it where the web server will run it gives an attacker a direct route to code execution: they upload a script and request it. This is CWE-434, unrestricted upload of a file with a dangerous type, which OWASP maps to A06:2025 Insecure Design.

• Allow only the types you need, checked by content, not only by extension.
• Rename files and store them outside the web root, or on a separate domain that runs nothing.
• Limit size and scan where it matters. The OWASP File Upload Cheat Sheet lists the full set.

Command separators, shell metacharacters and the names of common system programs in a parameter are distinctive, and rule sets match them. That protects an injectable call while it is fixed.

A filter misses encodings it does not decode, code injection in a language its rules do not describe, and uploads whose danger is in the file's contents rather than the request's shape. It also cannot remove the shell call; the next variation may get through.

1. Avoid calling the shell. Use a library function for the task, or run the program with a fixed argument list and no shell; the OWASP OS Command Injection Defense Cheat Sheet puts this first.
2. Never evaluate input as code. No eval on request data; template engines in a mode that does not run expressions from users.
3. Validate against an allow-list. For the few values that must reach a command, accept only known-good forms.
4. Run with the least privilege. A process that cannot read secrets or write to the web root limits what an injection achieves.
5. Patch libraries promptly. Many RCE flaws are in dependencies, not in your own code.