LocalCommandExecutor Command Injection Fix: Unescaped Shell Metachars with POC

Vulnerability Overview Vulnerability Type: Command Injection Location: class Root Cause: When constructing commands, special characters in the parameter (such as , , , , etc.) are not adequately escaped, allowing attackers to achieve command injection by crafting payloads with these special characters. Affected Scope Affected Files: - (core fix) - (new security tests) Affected Versions: and earlier versions Fixed Versions: and later versions Remediation 1. Added method: Escapes double quotes to prevent double-quote escape. 2. Added method: Escapes single quotes to prevent single-quote escape. 3. Added method: Escapes shell metacharacters ( , , , , , , , , , , , , , , , ). 4. Added method: Escapes backslashes. 5. Added method: Escapes the dollar sign. 6. Added method: Escapes . 7. Added method: Escapes . 8. Added method: Escapes . 9. Added method: Escapes parentheses. 10. Added method: Escapes angle brackets. 11. Added method: Escapes . 12. Added method: Escapes . 13. Added method: Escapes . 14. Added method: Escapes . 15. Added method: Escapes . 16. Added method: Escapes . 17. Added method: Escapes . 18. Added method: Escapes . POC Code ```java @Test void testCommandInjection() { // 1. Command Injection: via double-quote escape String payloadDoubleQuotes = String.format("\"; touch /tmp/pwned.txt\""); String payloadSingleQuotes = String.format("'& touch /tmp/pwned.txt'"); String payloadShellMetacharacters = String.format("& touch /tmp/pwned.txt"); String payloadDollarSign = String.format("$ touch /tmp/pwned.txt"); String payloadAmpersand = String.format("& touch /tmp/pwned.txt"); String payloadPipe = String.format(" String payloadSemicolon = String.format("; touch /tmp/pwned.txt"); String payloadParentheses = String.format("(touch /tmp/pwned.txt)"); String payloadAngleBrackets = String.format(""); String payloadExclamationMark = String.format("! touch /tmp/pwned.txt"); String payloadAsterisk = String.format(" touch /tmp/pwned.txt"); String payloadQuestionMark = String.format("? touch /tmp/pwned.txt"); String payloadHash = String.format("touch /tmp/pwned.txt"); String payloadTilde = String.format("~ touch /tmp/pwned.txt"); String payloadBackslash = String.format("\\ touch /tmp/pwned.txt"); String payloadCaret = String.format("^ touch /tmp/pwned.txt"); String payloadPercent = String.format("% touch /tmp/pwned.txt"); // 2. Command Injection: via single-quote escape String payloadSingleQuotes = String.format("'& touch /tmp/pwned.txt'"); // 3. Command Injection: via shell metacharacters String payloadShellMetacharacters = String.format("& touch /tmp/pwned.txt"); // 4. Command Injection: via dollar sign String payloadDollarSign = String.format("$ touch /tmp/pwned.txt"); // 5. Command Injection: via & symbol String payloadAmpersand = String.format("& touch /tmp/pwned.txt"); // 6. Command Injection: via String payloadPipe = String.format(" // 7. Command Injection: via ; symbol String payloadSemicolon = String.format("; touch /tmp/pwned.txt"); // 8. Command Injection: via parentheses String payloadParentheses = String.format("(touch /tmp/pwned.txt)"); // 9. Command Injection: via angle brackets String payloadAngleBrackets = String.format(""); // 10. Command Injection: via ! symbol String payloadExclamationMark = String.format("! touch /tmp/pwned.txt"); // 11. Command Injection: via symbol String payloadAsterisk = String.format("* touch /tmp/pwned.txt"); // 12. Command Injection: via ? symbol String payloadQuestionMark = String.format("? touch /tmp/pwned.txt"); // 13. Command Injection: via symbol String payloadHash = String.format("touch /tmp/pwned.txt"); // 14. Command Injection: via ~ symbol String payloadTilde = String.format("~ touch /tmp/pwned.txt"); // 15. Command Injection: via \ symbol String payloadBackslash = String.format("\\ touch /tmp/pwned.txt"); // 16. Command Injection: via ^ symbol String payloadCaret = String.format("^ touch /tmp/pwned.txt"); // 17. Command Injection: via % symbol String payloadPercent = String.format("% touch /tmp/pwned.txt"); // 18. Command Injection: via backslash String payloadBackslash = String.format("\\ touch /tmp/pwned.txt"); // 19. Command Injection: via ^ symbol String payloadCaret = String.format("^ touch /tmp/pwned.txt"); // 20. Command Injection: via % symbol String payloadPercent = String.format("% touch /tmp/pwned.txt"); // 21. Command Injection: via backslash String payloadBackslash = String.format("\\ touch /tmp/pwned.txt"); // 22. Command Injection: via ^ symbol String payloadCaret = String.format("^ touch /tmp/pwned.txt"); // 23. Command Injection: via % symbol String payloadPercent = String.format("% touch /tmp/pwned.txt"); // 24. Command Injection: via backslash String payloadBackslash = String.format("\\ touch /tmp/pwned.txt"); // 25. Command Injection: via ^ symbol String payloadCaret = String.format("^ touch /tmp/pwned.txt"); // 26. Command Injection: via % symbol String payloadPercent = String.format("% touch /tmp/pwned.txt"); // 27. Command Injection: via b

Goal Reached Thanks to every supporter — we hit 100%!

LocalCommandExecutor Command Injection Fix: Unescaped Shell Metachars with POC

More from this source