Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) |
| OWASP | A01:2017 - Injection |
| Confidence Level | Low |
| Impact Level | High |
| Likelihood Level | Low |
Description#
Spawning operating system processes with dynamic or externally influenced input can allow attackers to inject and execute malicious commands. This happens when functions like os.spawn* or os.posix_spawn* use variables that may contain untrusted data.
Impact#
If exploited, an attacker could run arbitrary commands on your server, leading to data theft, data loss, or full system compromise. This could result in unauthorized access, disruption of service, or further attacks on your infrastructure.