Description

Detects command injection vulnerabilities in C# applications where Process.Start() is called with unvalidated input. This vulnerability could allow attackers to execute arbitrary system commands by injecting malicious input into process execution parameters.

Detection Strategy

• Identifies calls to Process.Start() method in C# code

• Examines arguments passed to Process.Start() to check if they contain unvalidated or potentially tainted input

• Reports a vulnerability when Process.Start() receives parameters that could be controlled by external input without proper validation

Vulnerable code example

using System;
using System.Diagnostics;

public class UnsafeCommand {
    public void ExecuteUnsafe() {
        string userInput = Console.ReadLine();
        Process.Start(userInput);  // Vulnerable: Direct execution of user input without validation
    }...

✅ Secure code example

using System;
using System.Diagnostics;

public class SafeCommand {
    private static readonly string[] allowedCommands = { "notepad.exe", "calc.exe" }; // Whitelist of allowed executables

    public void ExecuteSafe() {
        string userInput = Console.ReadLine();...