英文:
Is it possible to do command injection in os/exec Command method?
问题
我的目标是了解是否安全使用os/exec包中的Command方法。这很重要，因为我要处理来自互联网的文件。在将文件添加到exec.Command()之前，我需要对文件进行清理吗？
我已经尝试过：
- 尝试使用
&&，但不起作用。
injection := "&& sh bash.sh"
out, err := exec.Command("ls", injection).Output()
fmt.Println(string(out), err)
bash.sh
#!/bin/bash
echo "Hello World"
英文:
My goal is to understand whether it is safe to use the Command method from os/exec package. This is important because I process file from the internet. Do I need to sanitize the file before adding it to exec.Command() ?
What I've did:
- Tried to use
&&, it does not work.
injection := "&& sh bash.sh"
out, err := exec.Command("ls", injection).Output()
fmt.Println(string(out), err)
bash.sh
#!/bin/bash
echo "Hello World"
答案1
得分: 1
由于您只是将这些参数传递给ls，而不是sh，因此没有（明显的）机会进行“命令注入”，但仍然有很多机会进行捣乱。
至少，有人可能能够传递一个可能会使ls崩溃或导致磁盘疯狂运转的参数。像*/***********/****或../../../../../../../或其他奇怪的组合可能会产生意想不到的结果。（我记得过去曾经读到过使用类似路径的Web服务器漏洞，导致系统崩溃或挂起，试图解析一个“不可能”的路径）
此外，根据您对ls结果的处理方式，用户可能能够利用它来获取有关您系统的特权信息。例如，有人可能将/home作为参数传递，并返回您系统上所有用户的列表。如果您的服务以root身份运行，他们可能能够从/var、/dev或其他地方的各个点获取其他特权信息。
最后，如果ls中存在漏洞，有人可能能够利用它来执行，嗯，无论该漏洞允许做什么。
英文:
As you're only passing thes arguments to ls, and not to sh, there's not really any (obvious) opportunity for "command injection", but there's still plenty of opportunity for shennanigans.
At the very least, someone may be able to pass an argument that could crash ls, or cause your disks to thrash. Arguments like */***********/**** or ../../../../../../../ or other odd combinations might do unexpected things. (I recall reading of web server exploits in the past using similar paths and causing a crash or hang of the system, trying to resolve an "impossible" path)
Further, depending on what you do with the result of ls, the user may be able to use this to learn priviledged information about your system. For example, someone might pass /home as an argument, and be returned a list of all users on your system. If your service is running as root, they may be able to get other priveledged information from various points in /var or /dev or elsewhere.
And finally, if there's ever a bug in ls, someone may be able to take advantage of that to do, well, whatever the bug permits.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论