Looking across the threat landscape at cybercriminals’ go-to attack vectors, we see SQL injection high on the list. But there’s another injection method that also poses a serious threat: command injection.

Shellshock: The Vulnerability That Won’t Die

In late September 2014, a more than 20-year-old vulnerability in the GNU Bash shell, which was widely used on Linux, Solaris and OS X systems, sparked the mobilization of attacks known as Shellshock. This first vulnerability quickly gave way to the disclosure of several additional vulnerabilities affecting the UNIX shell.

IBM Managed Security Services (MSS) observed a significant increase in focused attacks targeting these vulnerabilities within 24 hours of their disclosure. The attacks came in waves, from different source IPs and originating countries. Almost two years later, we are still seeing a significant amount of Shellshock attacks.

Read the IBM research report on The importance of thwarting command injection attacks

Details About Command Injection Attacks

A successful command injection attack allows an attacker to issue arbitrary commands within a vulnerable web application environment. This happens when an application passes malicious user-supplied input — via, for example, forms, cookies or HTTP headers — to a system shell. If the data input is not validated properly, the attacker can inject additional shell commands and have them executed with the permission of the vulnerable application. Simply put, this means that a critical web server and its entire back-end database can be completely compromised.

Because command injection attacks are one of the most common and successful attacks on the web, they are not likely to fade away anytime soon. Defending against these attacks requires implementation of strict defensive tactics, which are often overlooked when web applications are initially deployed — especially those applications developed in-house.

The IBM report “The Importance of Thwarting Command Injection Attacks” takes a more focused look at how these attacks are perpetrated and how you can protect your web environment from them.

More from Software Vulnerabilities

Analysis of a Remote Code Execution (RCE) Vulnerability in Cobalt Strike 4.7.1

Command & Control (C2) frameworks are a very sensitive component of Red Team operations. Often, a Red Team will be in a highly privileged position on a target’s network, and a compromise of the C2 framework could lead to a compromise of both the red team operator’s system and control over beacons established on a target’s systems. As such, vulnerabilities in C2 frameworks are high priority targets for threat actors and Counterintelligence (CI) operations. On September 20, 2022, HelpSystems published…

Controlling the Source: Abusing Source Code Management Systems

For full details on this research, see the X-Force Red whitepaper “Controlling the Source: Abusing Source Code Management Systems”. This material is also being presented at Black Hat USA 2022. Source Code Management (SCM) systems play a vital role within organizations and have been an afterthought in terms of defenses compared to other critical enterprise systems such as Active Directory. SCM systems are used in the majority of organizations to manage source code and integrate with other systems within the…

X-Force Research Update: Top 10 Cybersecurity Vulnerabilities of 2021

From 2020 to 2021, there was a 33% increase in the number of reported incidents caused by vulnerability exploitation, according to the 2022 X-Force Threat Intelligence Index. A large percentage of these exploited vulnerabilities were newly discovered; in fact, four out of the top five vulnerabilities in 2021 were newer vulnerabilities. Vulnerability exploitation was the second most common initial infection vector observed by IBM Security X-Force in 2021, falling closely behind phishing. Cybercriminals are finding new ways of bypassing security…

How Log4j Vulnerability Could Impact You

MITIGATION UPDATE: New vulnerability in 2.17 — CVE-2021-44832 Upgrade to 2.17.1 to mitigate this vulnerability Do NOT enable JNDI in any versions Follow: https://logging.apache.org/log4j/2.x/security.html If you hadn’t heard of Apache Log4j, chances are it’s on your radar now. In fact, you may have been using it for years. Log4j is a logging library. Imagine writing your daily activities into a notebook. That notebook is Log4j. Developers and programmers use it to take notes about what’s happening on applications and servers.…