Description

Command injection vulnerability where untrusted user input from a web request can be passed to Process.Start() in C# web applications, allowing execution of arbitrary system commands. This is particularly dangerous in ASP.NET MVC controllers where user-controlled data could be used to specify process arguments.

Detection Strategy

• Check if the application imports System.Diagnostics namespace (required for Process class) and ASP.NET MVC related namespaces

• Look for Process.Start() method calls within MVC controller endpoint methods

• Verify the Process object is created and configured with user-controllable input

• Confirm the code path allows external input to influence the process arguments or command

Vulnerable code example

using System.Diagnostics;
using Microsoft.AspNetCore.Mvc;

public class CommandController : Controller
{
    [HttpGet]
    public void ExecuteCommand(string userInput)
    {...

✅ Secure code example

using System.Diagnostics;
using Microsoft.AspNetCore.Mvc;
using System.Text.RegularExpressions;

public class CommandController : Controller
{
    private static readonly Regex SafeInputPattern = new Regex(@"^[a-zA-Z0-9\s-]+$"); // Only allow alphanumeric, spaces and hyphens
    ...