Vulnerable Application Lab

Setup Instructions

1. Prerequisites:
   • Install Docker and Docker Compose.
2. Build and Run the Application:

   docker-compose up --build
   

Vulnerability Report: Command Injection in Health Check Service

This report details a critical command injection vulnerability in the provided Health Check Service, a Go-based HTTP application that performs network ping operations. The vulnerability allows unauthenticated remote attackers to execute arbitrary system commands, potentially leading to full system compromise. This report outlines the vulnerability, its exploitation, impact, and recommended remediation steps.

Vulnerability Overview

Description

The Health Check Service is vulnerable to command injection due to improper handling of user input in the HTTP handler for the /ping endpoint. Specifically, the host query parameter is directly concatenated into a shell command without sanitization, allowing attackers to inject malicious commands.

• CVE Reference: No specific CVE is assigned to this custom application vulnerability, but it falls under the class of command injection vulnerabilities (CWE-77: Improper Neutralization of Special Elements used in a Command).
• Root Cause: The vulnerability stems from the direct inclusion of the host query parameter in the exec.CommandContext call ("ping -c 1 "+host) without validation or sanitization. The command is executed via a shell (sh -c), which interprets special characters like &&, ;, or | as command separators, enabling attackers to append arbitrary commands.

Class of Vulnerability

Command injection occurs when untrusted user input is passed to a system command execution function without proper sanitization, allowing attackers to execute unintended commands. In this case, the application uses the os/exec package to run a ping command through a shell, which evaluates the entire input string, including any injected commands. This is particularly dangerous because:

• Shell commands interpret special characters (e.g., &&, ;, |) as command separators or pipes.
• No input validation ensures that the host parameter contains only safe characters (e.g., alphanumeric, dots, or hyphens).
• The application runs with the privileges of the underlying process, potentially allowing access to sensitive system resources.

Exploitation

Exploit Details

The vulnerability can be exploited by crafting a malicious host parameter that includes shell metacharacters to execute additional commands. The provided test script demonstrates this by appending &&env to the host parameter, which runs the env command to display environment variables.

Steps to Reproduce

1. Setup: Deploy the application using the provided Docker configuration.
   • Build and run the Docker container: docker-compose up --build.
   • The service listens on http://localhost:8080/ping.
2. Normal Request: A legitimate request like curl "http://localhost:8080/ping?host=127.0.0.1" pings the localhost and returns the output.
3. Malicious Request: A crafted request like curl "http://localhost:8080/ping?host=127.0.0.1%26%26env" (where %26%26 is URL-encoded &&) injects the env command, which executes after the ping command, returning environment variables in the response.

Exploit Script

#!/bin/bash

# Normal behavior
echo "[*] Normal request:"
curl "http://localhost:8080/ping?host=127.0.0.1"

# Exploit script
echo -e "\n\n[*] Exploit with command injection:"
curl "http://localhost:8080/ping?host=127.0.0.1%26%26env"

Remediation and Mitigation

Immediate Mitigation

1. Disable the Endpoint: Temporarily disable the /ping endpoint to prevent exploitation, as demonstrated by the malicious request in exploit/exploit.sh, which injects commands like ls -la.
2. Restrict Network Access: Use a firewall to limit access to port 8080 to trusted IPs, reducing the attack surface for exploits like those shown in exploit/exploit.sh.
3. Monitor Logs: Inspect access logs for suspicious host parameter values (e.g., containing &&, ;, |) to detect attempts similar to the command injection in exploit/exploit.sh.

Code-Level Fixes

1. Avoid Shell Execution:
   • Modify the handler function to use exec.CommandContext directly with ping and its arguments, bypassing shell interpretation that enables the vulnerability exploited in exploit/exploit.sh.
   • Example:

     cmd := exec.CommandContext(ctx, "ping", "-c", "1", host)