Injection: CGI-bin Remote Code Execution¶

Identifier: cgi_bin_rce

Scanner(s) Support¶

GraphQL Scanner	REST Scanner	WebApp Scanner	ASM Scanner

Description¶

CGI-bin remote code execution vulnerabilities occur when legacy CGI endpoints under /cgi-bin/ execute user-controlled input as shell commands without proper validation.

How we test: We probe common /cgi-bin/ script paths (including /cgi-bin/bash) with safe command-injection payloads and out-of-band callbacks. Detection relies on arithmetic canaries, shell output indicators, and HTTP or DNS pingbacks to Escape monitoring endpoints.

Prerequisites:

The target must expose /cgi-bin/ endpoints or allow path probing against them.

References:

https://owasp.org/www-community/attacks/Command_Injection

Configuration¶

Example¶

Example configuration:

---
security_tests:
  cgi_bin_rce:
    skip: false

Reference¶

`skip`¶

Type : boolean

Skip the test if true.