Security Test: Command Injection¶

Description¶

Default Severity: high

Command injection happens when a program lets a user input affect system commands without proper checks, so an attacker can sneak in and run any command they want. This is really dangerous because it gives an attacker full control over parts of your system—imagine someone being able to delete files or steal data by exploiting a weak point in your app. It often occurs because developers assume user input is safe, and they don’t properly filter or validate what’s coming in. The impact can be severe, affecting data confidentiality and system integrity, and potentially turning your server into a launching pad for further attacks.

Reference:

• https://owasp.org/www-community/attacks/Command_Injection

Configuration¶

Identifier: injection/command

Examples¶

All configuration available:

checks:
  injection/command:
    skip: false # default
    options:
      skip_objects: # cf. Options below

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶