Argument injection occurs when an application constructs command-line arguments from user-supplied input without properly sanitizing or escaping special…
Argument injection occurs when an application constructs command-line arguments from user-supplied input without properly sanitizing or escaping special characters. An attacker can inject additional arguments or flags that alter the intended behavior of the command, potentially leading to unauthorized actions, information disclosure, or system compromise.
When software passes user input directly into command-line arguments—whether through shell execution, system calls, or subprocess invocation—it assumes the input will be treated as a single, literal value. However, many command-line tools interpret special characters (spaces, hyphens, quotes, pipes) as delimiters or flags. If an attacker controls part of an argument, they can inject new flags or arguments that the application never intended to pass, causing the underlying tool to behave differently than expected.
The vulnerability is especially common in applications that invoke external tools (compilers, image processors, file utilities, etc.) or construct arguments for system commands based on user input. Unlike command injection, which executes entirely new commands, argument injection modifies the arguments of an existing command to achieve unintended effects.
Argument injection can lead to serious consequences depending on the command being invoked. An attacker might inject flags that disable security checks, output sensitive files, overwrite critical data, or bypass authentication mechanisms. For example, injecting arguments into a backup utility could cause it to restore from an attacker-controlled location, or injecting flags into a compiler could cause it to generate code with embedded malicious logic. The impact ranges from information disclosure to complete system compromise.
import subprocess
import sys
def process_image(filename):
user_input = sys.argv[1]
# Directly concatenating user input into argument list
cmd = ["convert", "-resize", user_input, filename, "output.jpg"]
subprocess.run(cmd, check=True)
process_image("input.jpg")Why it's vulnerable:
The user_input is passed directly as a command argument without validation. An attacker could supply a value like 100x100 -quality 1 or @/etc/passwd to inject additional arguments that the convert tool will interpret and execute.
import subprocess
import sys
import re
def process_image(filename):
user_input = sys.argv[1]
# Validate input against a strict allowlist pattern
if not re.match(r'^\d+x\d+$', user_input):
raise ValueError("Invalid resize format")
cmd = ["convert", "-resize", user_input, filename, "output.jpg"]
subprocess.run(cmd, check=True)
process_image("input.jpg")<?php
$filename = $_GET['file'];
$quality = $_GET['quality'];
// Directly concatenating user input into shell command
$cmd = "convert -quality " . $quality . " " . $filename . " output.jpg";
shell_exec($cmd);
?>Why it's vulnerable:
The $quality parameter is concatenated directly into the shell command string. An attacker could supply 80 -strip all or other flags to inject unintended behavior into the ImageMagick command.
<?php
$filename = $_GET['file'];
$quality = $_GET['quality'];
// Validate quality is a numeric value within acceptable range
if (!is_numeric($quality) || $quality < 1 || $quality > 100) {
die("Invalid quality value");
}
// Use escapeshellarg() to safely escape the filename
$safe_filename = escapeshellarg($filename);
$cmd = "convert -quality " . intval($quality) . " " . $safe_filename . " output.jpg";
shell_exec($cmd);
?>subprocess.run() with a list, not a shell string) to avoid shell interpretation of special characters.
escapeshellarg() in PHP, shlex.quote() in Python) if you must pass user input as a shell argument.
Review application logs for unexpected command-line arguments or unusual tool behavior (e.g., image processing tools generating files in unexpected locations, backup utilities restoring from wrong sources, or compilers producing unexpected output). Check for user-supplied input that appears in system call traces or process monitoring logs without sanitization. If you invoke external tools and accept user input for any argument, audit those code paths immediately.
