allow software to programmatically execute a command line. Here is an example vulnerable tcsh script: #!/bin/tcsh # check arg outputs it matches if arg is one if ($1 == 1) echo it matches If the above is stored in the executable file ./check, the shell command ./check " 1 ) evil" will attempt to execute the injected shell command evil instead of comparing the argument with the constant one. Here, the code under attack is the code that is trying to check the parameter, the very code that might have been trying to validate the parameter in order to defend against an attack. Any function that can be used to compose and run a shell command is a potential vehicle for launching a shell injection attack. Among these are system(), StartProcess(), and System.Diagnostics.Process.Start(). Client–server systems such as web browser interaction with web servers are potentially vulnerable to shell injection. Consider the following short PHP program that can run on a web server to run an external program called funnytext to replace a word the user sent with some other word. <?php passthru("/bin/funnytext " . $_GET['USER_INPUT']); The passthru in the above composes a shell command that is then executed by the web server. Since part of the command it composes is taken from the URL provided by the web browser, this allows the URL to inject malicious shell commands. One can inject code into this program in several ways by exploiting the syntax of various shell features (this list is not exhaustive): Some languages offer functions to properly escape or quote strings that are used to construct shell commands: PHP: escapeshellarg() and escapeshellcmd() Python: shlex.quote() However, this still puts the burden on programmers to know/learn about these functions and to remember to make use of them every time they use shell commands. In addition to using these functions, validating or sanitizing the user input is also recommended. A safer alternative is to use APIs that execute external programs directly, rather than through a shell, thus preventing the possibility of shell injection. However, these APIs tend to not support various convenience features of shells, and/or to be more cumbersome/verbose compared to concise shell-syntax. See also Arbitrary code execution Buffer overflow Debugging File inclusion vulnerability Gadget (machine instruction sequence) Mobile code Machine code monitor Prompt injection SGML entity Shellshock (software bug) SQL injection Trojan horse (computing) Unintended instructions Web skimming References External links