Description

This detector identifies OS command injection vulnerabilities in Rust applications using the Actix Web framework. Command injection occurs when user-controlled data is passed to system command execution functions without proper sanitization, allowing attackers to execute arbitrary commands on the server.

Detection Strategy

• Scan Rust source code files that import the 'actix_web' library or any module with 'actix_web' prefix

• Identify calls to vulnerable command execution functions including Command::new(), shell argument functions, and shell args functions

• Flag locations where these command execution functions are called with potentially unsafe parameters that could allow user input to be interpreted as system commands

Vulnerable code example

use actix_web::{web, HttpResponse};
use std::collections::HashMap;
use std::process::Command;

async fn ping(query: web::Query<HashMap<String, String>>) -> HttpResponse {
    let host = query.get("host").unwrap();
    
    // VULNERABLE: user input passed to shell command via sh -c...

✅ Secure code example

use actix_web::{web, HttpResponse};
use std::collections::HashMap;
use std::process::Command;

async fn run_script(query: web::Query<HashMap<String, String>>) -> HttpResponse {
    let script_path = query.get("script_path").unwrap();
    
    // SAFE: no "-c" flag, so sh treats the argument as a script path to...