Argument Injection – Vulnerabilities
Posted by
Argument injection is a type of attack based on tampering with the input parameters of a page. This can enable attackers to see data which they normally cannot see or modify data which they normally cannot modify, via the user interface.
Argument injection is similar to command injection as tainted data is passed to a command executed in a shell without proper sanitization/escaping.
It can happen in different situations, where you can only inject arguments to a command:
- Improper sanitization (regex)
- Injection of arguments into a fixed command (PHP:escapeshellcmd, Python: Popen)
- Bash expansion (ex: *)
In the following example, a python script takes the inputs from the command line to generate a curl
command:
from shlex import quote,split
import sys
import subprocess
if __name__=="__main__":
command = ['curl']
command = command + split(sys.argv[1])
print(command)
r = subprocess.Popen(command)
It is possible for an attacker to pass several words to abuse options from curl
command
We can see by printing the command that all the parameters are split allowing us to inject of an argument that will save the response in an arbitrary file.
List of exposed commands
CURL
It is possible to abuse curl
through the following options:
-o, --output <file> Write to file instead of stdout
-O, --remote-name Write output to a file named as the remote file
In case there is already one option in the command it is possible to inject several URLs to download and several output options. Each option will affect each URL in sequence.
TAR
For the tar
command it is possible to inject arbitrary arguments in different commands.
Argument injection can happen into the ”’extract”’ command:
--to-command <command>
--checkpoint=1 --checkpoint-action=exec=<command>
-T <file> or --files-from <file>
Or in the ”’create”’ command:
There are also short options to work without spaces:
FIND
Find some_file inside /tmp directory.
Print /etc/passwd content.
WGET
Example of vulnerable code
Arbitrary file write