VNX-553: Command Shell in Externally Accessible Directory

Field	Value
Rule ID	VNX-553
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Shell, Dockerfile, Perl, Python
CWE	CWE-553
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	web-shell cgi cwe-553
Source	internal/sast/rules/vnx-553.rego

Overview

VNX-553 maps to CWE-553: Command Shell in Externally Accessible Directory. It reports the ways a command shell ends up where a web visitor can run it.

Why This Matters

A shell in cgi-bin or the document root is remote command execution with no exploit needed: GET /cgi-bin/bash?... runs whatever the visitor sends. A CGI script that evals its query string is the same thing written by hand: a web shell.

What Gets Flagged

A deployment step that copies, links or installs a shell into a web-served directory:

RUN cp /bin/bash /usr/local/apache2/cgi-bin/bash      # FLAGGED
RUN ln -s /bin/sh /var/www/html/sh                    # FLAGGED

An Apache ScriptAlias onto a directory of system binaries:

ScriptAlias /tools/ "/bin/"                           # FLAGGED

A CGI program that runs request input as a command:

CMD=$(echo "$QUERY_STRING" | sed 's/^cmd=//')
eval "$CMD"                                           # FLAGGED

form = cgi.FieldStorage()
command = form.getvalue("cmd", "uptime")
os.system(command)                                    # FLAGGED

my $host = param('host');
print `ping -c 1 $host`;                              # FLAGGED

Not flagged: copying a CGI script (not a shell) into cgi-bin, linking a shell outside the web root, CGI programs that only compare the query string with fixed cases or print it, subprocess calls with a fixed argument list, reading the SHELL environment variable, and comments.

Remediation

1. Remove shell interpreters from every web-served directory and from ScriptAlias targets.
2. Never pass request input to eval, sh -c, system, os.system or backticks. Map the request onto a fixed set of actions (case "$QUERY_STRING" in report=disk) df -h ;; esac).
3. Run CGI programs as an unprivileged user and disable mod_cgi where it is not needed.

References

• CWE-553: Command Shell in Externally Accessible Directory
• OWASP Command Injection

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-553
// nosec vnx-553

Or record an ignore rule: vulnetix ignore add --rule vnx-553 --reason "...". See Suppressing findings.