5 lines
391 B
Plaintext
5 lines
391 B
Plaintext
Applications that allow execution of operating system commands from user-controlled data should control the command to execute, otherwise an attacker can inject arbitrary commands which will compromised the underlying operating system.
|
|
|
|
|
|
The mitigation strategy can be based on a list of authorized and safe commands to execute and when a shell is spawned to sanitize shell meta-characters.
|