From 3712baf28ab66db4747a47c209da9774da097d36 Mon Sep 17 00:00:00 2001 From: Semgrep Autofix Date: Tue, 17 Mar 2026 07:37:35 +0000 Subject: [PATCH] Fix command injection vulnerability in grep_processes endpoint Fix command injection vulnerability in `grep_processes` by removing `shell=True` and processing output safely in Python. ## Changes - Replaced `shell=True` subprocess call with safe argument list `["ps", "aux"]` - Moved grep filtering and awk field extraction to Python code - User input is no longer interpolated into shell commands ## Why The original code concatenated user input directly into a shell command string with `shell=True`, allowing attackers to inject arbitrary commands (e.g., `; rm -rf /`). The fix eliminates shell interpretation entirely by passing arguments as a list and filtering results in Python, following the secure-by-default approach recommended by Semgrep. ## Semgrep Finding Details Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. Untrusted input in a command can lead to command injection, allowing attackers to execute arbitrary commands and gain control of the system. To prevent this: 1. Avoid direct command execution: Don't run OS commands with user input directly. 2. Validate and sanitize input: Ensure input is safe by removing or escaping dangerous characters. 3. (preferred) Use safe methods: Use `subprocess.run` without `shell=True` to safely execute commands, as it doesn't call a system shell by default. If `shell=True` is necessary, properly quote and escape all input to prevent shell injection. This is a secure by default approach. @267212124 requested Semgrep Assistant generate this pull request to fix [a finding](https://semgrep.dev/orgs/studentsca023_personal_org/findings/722169010) from the detection rule [python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default). --- flask_webgoat/actions.py | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/flask_webgoat/actions.py b/flask_webgoat/actions.py index f75e57eb..8820d7b2 100644 --- a/flask_webgoat/actions.py +++ b/flask_webgoat/actions.py @@ -40,16 +40,22 @@ def log_entry(): @bp.route("/grep_processes") def grep_processes(): name = request.args.get("name") - # vulnerability: Remote Code Execution + # Fixed: avoid shell=True to prevent command injection res = subprocess.run( - ["ps aux | grep " + name + " | awk '{print $11}'"], - shell=True, + ["ps", "aux"], capture_output=True, ) if res.stdout is None: return jsonify({"error": "no stdout returned"}) out = res.stdout.decode("utf-8") - names = out.split("\n") + lines = out.split("\n") + # Filter lines containing the name and extract the 11th field (command) + names = [] + for line in lines: + if name and name in line: + parts = line.split() + if len(parts) >= 11: + names.append(parts[10]) # 0-indexed, so field 11 is index 10 return jsonify({"success": True, "names": names})