Executing commands obtained from data from an untrusted source is insecure.

Injection vulnerabilities take the first place in the “OWASP Top 10 2017” web-application vulnerabilities ranking. Command injection vulnerabilities are divided into two categories:

An attacker modifies the command itself;
An attacker replaces the value of the environment variables, which implicitly changes the semantics of the command being executed.

In the given case, the application is prone to the vulnerability of the first type.

A possible attack scenario:

The application receives input data from an untrusted source, for example, user input.
The data obtained is used as a part of the string that defines the command.
Execution of the command gives an attacker the privileges which he did not previously possess.

A lot of the time, code uses shell=True because it’s convenient. The shell provides the ability to pipe things around without buffering them in memory, and allows a malicious user to chain

additional commands after a legitimate command is run.
There are a lot of functions that uses curl to grab a page from a website. The functions is insecure because it uses shell=True, which allows shell injection. A user to who instructs your code to fetch the website ; rm -rf / can do terrible things to what used to be your machine.
If we convert the function to use shell=False, it doesn’t work. This does not fix the issue, rather it causes it to be more broken than before.
The following modules and functions are the most common for shell injections: ['subprocess.Popen', 'subprocess.call', 'subprocess.check_call', 'subprocess.check_output', 'subprocess.run', 'os.system', 'os.popen', 'os.popen2', 'os.popen3', 'os.popen4', 'popen2.popen2', 'popen2.popen3', 'popen2.popen4', 'popen2.Popen3', 'popen2.Popen4']
When a command is executed with the shell = True parameter, it is executed through the shell. The program is interpreted in accordance with the syntax and semantic rules of the called shell. In this case, the user must follow these rules. Thus, the user can execute the programs being listened to.

Python : Command injection

DerScanner Severity Score

Do you want to fix Python : Command injection in your application?

See also