#commandinjection

[cyberdudebivash-news]

CVE-2025-68154 : Critical 10.0 RCE in Node.js Hijacks Windows Systems (The Mandatory Patch & Secret Rotation Guide).

Read the full report on -

CVE-2025-68154 : Critical 10.0 RCE in Node.js Hijacks Windows Systems (The Mandatory Patch & Secret Rotation Guide).

CyberDudeBivash offers real-time cybersecurity news, threat intelligence, zero-day vulnerabilities, malware reports, and security tools.

[it4intserversworld]

iT4iNT SERVER JPCERT Confirms Active Command Injection Attacks on Array AG Gateways http://dlvr.it/TPf16T VDS VPS Cloud

[cyberdudebivash-news]

New GitLab Flaws Let Attackers Inject Invisible Commands to Harvest Credentials

Read the full report on -

New GitLab Flaws Let Attackers Inject Invisible Commands to Harvest Credentials

CyberDudeBivash offers real-time cybersecurity news, threat intelligence, zero-day vulnerabilities, malware reports, and security tools.

[sqlinjection]

Navigation

Introduction

Description of method

Explanation of the technological principles (techniques) Examples Detailed description of possible security approaches and solutions Examples of two real-life cases and technical/financial/etc. damages Statistical information, comparison of data from the last few years on the use of technology Demonstration/simulation using a virtual machine Choice of a blogging tool, explanation and evaluation Conclusions/Suggestions/Guidelines/Trends/Future work more specific ones on the different types of injection: #sql #sqlinjection #ldap #oscommandinjection #commandinjection #xss

[sqlinjection]

Command (shell) injection example

examples speak louder than explanations!

e.g., a web-based CGI program allows users to change their passwords -> this program has a command to rebuild some password records by running the make command in the /var/yp directory:

system("cd /var/yp && make &> /dev/null");

unlike the previous examples, the command is hardcoded, so an attacker cannot control the argument passed to system(). seems safe, right? nuh-uh :)

key vulnerabilities:

program does not specify an absolute path for make, and does not scrub any environment variables prior to invoking the command

->

attacker can modify their $PATH to point to a malicious version of make, therefore their malicious version of make is executed instead of the intended /usr/bin/make

setuid root runs with root privileges, even if a regular user runs it. so, malicious version of make now runs with root privileges

btw, using Java at this point is more safe

Runtime.getRuntime().exec("cd /var/yp && make");

and here is why:

Runtime.exec does NOT try to invoke the shell at any point: it tries to split the string into an array of words, then executes the first word in the array with the rest of the words as parameters

therefore, it does not go through chaining commands using “&”, “&&”, “|”, “||”, etc, redirecting input and output and any mischief would simply end up as a parameter being passed to the first command, and likely causing a syntax error, or being thrown out as an invalid parameter

[sqlinjection]

Command (shell) injection

involves execution of arbitrary commands on the host operating system via a vulnerable application

applies to most systems which allow software to o programmatically execute a command line

examples speak louder than explanations!

vulnerable tcsh script looks as follows:

# !/bin/tcsh

# check arg outputs it matches if arg is one

if ($1 == 1) echo it matches

the script does not properly validate input argument: tsch interprets everything within the parentheses () as part of the if statement

so it is possible to run the following script:

./check "1 ) evil "

if statement now is:

if (1 ) evil == 1)

which is invalid syntax in normal scenario, however! because of shell parsing quirks it will execute evil command:

tcsh stops processing the if condition at the first syntax it recognises as complete (in our case, if (1 ))

then it sees evil as a standalone command (because it is separated from the if statement by parethesis) and interprets is as an executable command

! any function that can be used to compose and run a shell command is a potential vehicle for launching a shell injection attack e. g. :

system(), StartProcess(), System.Diagnostics.Process.Start().

[osintelligence]

Zyxel security advisory for authentication bypass and command injection vulnerabilities in NAS products | Zyxel Networks

https://bit.ly/4a2jHiK - 🌍 Zyxel has issued a security advisory for multiple vulnerabilities in their NAS products, specifically addressing an authentication bypass and several command injection issues. The vulnerabilities, identified by CVE numbers CVE-2023-35137, CVE-2023-35138, CVE-2023-37927, CVE-2023-37928, CVE-2023-4473, and CVE-2023-4474, pose significant risks to system security. Users are strongly advised to update their devices with the latest patches provided by Zyxel for enhanced protection. #CyberSecurity #ZyxelNAS #VulnerabilityUpdate 🔒 The identified vulnerabilities vary in their nature and potential impact. They range from improper authentication in the authentication module (CVE-2023-35137) to several command injection vulnerabilities in different components of Zyxel NAS devices (CVE-2023-35138, CVE-2023-37927, CVE-2023-37928, CVE-2023-4473, CVE-2023-4474). These vulnerabilities could allow both unauthenticated and authenticated attackers to execute operating system commands, leading to possible unauthorized access and control. #NetworkSecurity #CommandInjection #AuthenticationBypass 🔎 Affected Zyxel NAS models include NAS326 and NAS542, with specific firmware versions listed as vulnerable. Users of these models should refer to the advisory for the appropriate firmware patches. Zyxel’s proactive approach in identifying and addressing these issues reflects their commitment to customer security and product integrity. #FirmwareUpdate #NASsecurity #ZyxelAdvisory 💡 The discovery of these vulnerabilities was made possible thanks to the efforts of security researchers Maxim Suslov, Attila Szász from BugProve, and Drew Balfour from IBM X-Force. Their contributions underscore the importance of collaborative security research in identifying and mitigating potential cyber threats. #CyberResearch #CollaborativeSecurity #ThreatIntelligence 📅 As of November 30, 2023, Zyxel has released the initial advisory with detailed information on the vulnerabilities and the available patches. Users are encouraged to contact their local service representatives or visit Zyxel’s Community for additional information and support in addressing these security concerns.

[securityandducks6441]

DVWA Tutorial #3 - Command Injection

This method or attack is the most severe and common form of attack according to the OWASP Top 10 list. It is also perhaps the most interesting attack I’ve ever done from my limited experience. A quick definition from OWASP follows:

Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.

1. Probing

So the DVWA command injection page looks like this:

(Note: the links in the More Information section are REALLY helpful).

So quickly testing with a valid IP address:

And with an invalid address:

I also tried inputing nothing and pressing submit:

So this this shows that the application simply passes our input as an argument to the console command ping. i.e. it executes “ping [input]” and we see that output of our command in red.  If it doesnt work, then nothing happens.

2. Chaning Commands

We can execute more commands after our input by chaining them. Different operating systems will use different characters to chain. In linux, we can use ‘;’ to make commands run sequenctially or ‘&’  to make a command run in te background, In Windows, we can simply use ‘&’. If ‘;’ doesnt work, then we can conclude that the OS is Windows and vice versa.

3. Command Injection Attack

Basically, if the app doesn’t have any delimeter or character bans (to prevent ';' '&' or '|') then we can simply trick the app to continue executing any of the commands we want.  

So a basic attack string would be

127.0.0.1 & hostname

Now it turns out you can run basically anything according to the OS. A bunch of other commands I tried was cd, dir, mkdir, del, echo, more, ipconfig, find, and whoami?

This was the output after making a directory called ‘hello’:

It was also interesting to see that localhost and ::1 were valid ping adresses. But I am no computer expert so I have no idea why these are valid.