flawopen.com/Command Injection/Java

Command Injection in Java

Key terms on this page

ProcessBuilder

The modern, safe Java API for process creation that takes command arguments as a List<String> without a shell.

Runtime.exec(String)

Legacy Java API that tokenizes a single string using StringTokenizer, frequently leading to argument injection or shell execution traps.

What's happening

In Java applications, command injection typically occurs when developers call Runtime.getRuntime().exec(queryString) or construct a shell call (sh -c or cmd.exe /c) with concatenated request parameters.

Real-world impact

Vulnerable vs. fixed

// Runtime.exec with string concatenation
public class PingService {
    public void ping(String host) throws Exception {
        // Attacker input: "127.0.0.1; whoami"
        String command = "sh -c ping -c 1 " + host;
        Process process = Runtime.getRuntime().exec(command);
    }
}

// ProcessBuilder with discrete argument list
public class PingService {
    public void ping(String host) throws Exception {
        // host is strictly isolated as an argument
        List command = List.of("ping", "-c", "1", host);
        ProcessBuilder pb = new ProcessBuilder(command);
        Process process = pb.start();
    }
}

Why the fix works

ProcessBuilder passes the command and arguments as a distinct array directly to the underlying OS API (CreateProcessW on Windows or execve on Linux), bypassing shell command parsers completely.

Gotchas

Common misconceptions

How to check if you're affected

Prevention checklist

• ✓Always use ProcessBuilder(List<String>)
• ✓Never pass sh -c or cmd.exe /c with concatenated input
• ✓Validate arguments against a strict alphanumeric allowlist

FAQ

References

• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• OWASP OS Command Injection Defense Cheat Sheet