OS command injection via user-controlled input

ID

vbnet.inject.command_injection

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Inject

Language

VB.NET

Description

User-controlled input flows into OS command execution, which may allow command injection. Avoid passing untrusted input to Process.Start / ProcessStartInfo; validate against an allowlist and pass arguments individually rather than through a shell.

Rationale

User-controlled input flows into OS command execution, which may allow command injection. Avoid passing untrusted input to Process.Start / ProcessStartInfo; validate against an allowlist and pass arguments individually rather than through a shell.

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub QueryStringToProcessStart(ByVal Request As HttpRequest)
    Dim cmd As String = Request.QueryString("cmd")
    ' VULNERABLE: OS command injection via user-controlled input
    Process.Start(cmd)
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References