Command Injection Lab: Turn a Ping Tool Into a Shell

This article describes an interactive lab teaching OS command injection through a vulnerable ping tool that concatenates user input into shell commands. The lab demonstrates how attackers can inject shell metacharacters to execute arbitrary commands on the server with web server privileges. Command injection remains a critical real-world vulnerability, especially in network appliances and admin interfaces, and the article covers both exploitation techniques and defensive strategies.

• How the vulnerability works mechanicallyThe vulnerable application concatenates user input directly into a shell command string without escaping. When the shell parses this string, it treats metacharacters like semicolons, double ampersands, and pipes as command separators rather than literal text, allowing an attacker to append a second command that executes with the web server's permissions.
• Shell metacharacters enable command chainingA semicolon terminates one command and starts another; double ampersands run the next command if the first succeeds; a pipe sends one command's output to another. The lab teaches that if one separator is filtered, others remain available, making character blocklists an ineffective defense.
• Real-world prevalence in network devicesCommand injection is especially common in routers, VPNs, and firewalls with web admin pages that wrap system tools like ping and traceroute. The article cites CVE-2024-21887 in Ivanti Connect Secure, which was actively exploited in the wild in 2024 and appears in CISA's Known Exploited Vulnerabilities catalogue.
• Direct API calls eliminate shell interpretationThe primary defense is to avoid invoking a shell entirely by using APIs that pass a program and an argument array separately, such as execFile or subprocess with a list. This prevents the shell from parsing user input as metacharacters.
• Strict input validation provides defense in depthA host field should be validated to match only IP addresses or valid hostname patterns, rejecting anything else. Combined with direct API calls and least-privilege execution, this limits what an attacker can accomplish even if validation is bypassed.
• Use native libraries instead of shell utilitiesWhere feasible, replace shelled-out system commands with native libraries—for example, using ICMP or DNS libraries instead of calling ping or traceroute. This eliminates the injection vector entirely.
• Least privilege limits compromise scopeRunning the application with minimal required permissions means a successful command injection reaches only the restricted resources available to that user, reducing the damage from full server compromise.
• Timing attacks reveal injection successWhen testing for command injection in authorized scenarios, adding a harmless sleep command can reveal whether injection is possible by observing changes in response timing, providing a safe initial probe before attempting to extract data.

Bottom line: OS command injection remains prevalent and dangerous because developers often pass unsanitized user input to shells; the only reliable fix is to call programs directly with argument arrays and validate input against strict allowlists, avoiding shells entirely. Blocklisting metacharacters is ineffective because shells offer multiple command-chaining operators, making this vulnerability especially critical to test in network appliances and admin interfaces.