Command Injection
Insecure OS Firmware (Command Injection)
Overview of the Vulnerability
When Operating System (OS) firmware is insecure, it broadens the application’s attack surface and gives an attacker more opportunity to maintain persistence and achieve a high level of privilege within the application. Firmware can be exploited via network, software, or hardware layers. Once compromised, an attacker can establish persistence, capture sensitive data, exfiltrate data, impact application performance, or pivot into attacking the company’s wider network. An attacker could abuse this command injection vulnerability in the application to execute arbitrary commands on the user's operating system.
Business Impact
This vulnerability can lead to direct financial loss to the company due to data theft, application manipulation and corruption, or denial of service to customers and users of the application. It can also lead to reputational damage as customers may view the application as insecure.
Steps to Reproduce
Start {{application}} on the operating system and navigate to {{url}}
Observe that the OS firmware is insecure by {{action}}
Input the following payload into {{parameter}} to perform command injection:
{{Payload}}
Proof of Concept (PoC)
The screenshots below show the steps required to exploit the command injection:
{{screenshot}}
Guidance
Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. Your submission must include evidence of the vulnerability and not be theoretical in nature. For an operating system suffering from command injection, please include a video or detailed screenshots of the steps required to exploit the command injection within the application.
Attempt to show that the command injection could be used by a malicious attacker in some impactful way. If this is possible, provide a full Proof of Concept (PoC).
Recommendation(s)
It is recommended to validate and parameterise all user input to seperate user entered data and commands while. Additionally, it is best practice to not call OS commands directly and instead use built in library function to perform necessary tasks.
It is also best practice to keep all operating systems and firmware up to date with the latest version and include all firmware in a patch management lifecycle with a detailed firmware upgrade plan.
For further information, see:
Last updated