What is OS Command Injection?

Short answer

OS Command Injection is the attack of running the desired command on the server by adding an extra command through user input, with shell metacharacters such as ;, |, && or $( ), to a point where the application runs an operating system command; it occurs in applications that add the input directly to a shell command, and if it succeeds, control of the server can be taken over (CWE-78, OWASP). In TR7 WAF, the OS Command Execution category (373 rules) of the built-in Signature & Rule Library looks for these patterns in the query, form, JSON, header, path, XML and raw body; matching requests appear in WAF Event Logs with this category in the Category field.

Where It Is Used in TR7

Where	Field / label	What for
Configuration Menu → WAF → Signature & Rule Library; the OWASP Rules screen of the vService	The Signature Category column (hidden by default); Filter → Signature Categories → OS Command Execution	Listing the rules in the category; changing their state or score
WAF Event Logs and Global WAF Event Log	The Category column (hidden by default), the Category tab in the filter strip, the Category row on the Summary and Attacks tabs of the record preview	Seeing that the request was caught by a signature in this category
WAF Dashboard	The Detected Attacks by Category panel	The density of the detections in the category over time
WAF report	The Classification view	The category breakdown in the report

• The great majority of the signatures in the category are mapped to CWE-78 and to A03:2021 (Injection) in OWASP Top 10 Web; the mappings of a rule are seen on the Classification tab in the preview: How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?
• All the category names and rule counts: Which attack categories do the signatures cover?

Common Misconceptions

• "Only Linux servers are affected." Any operating system that has a command shell can be a target; the signatures of the category cover Unix and Windows command patterns together.
• "If the command output does not appear in the response, the attack has failed." Commands that return no output (blind) can also run; their effect is understood from side effects such as a delay or a connection opened to the outside.
• "OS Command Injection and SQL Injection are the same thing." Both belong to the injection family; one targets the operating system shell, the other the database query, and in TR7 they are tracked in separate categories: What is SQL Injection?

How it is done in the documentation

• Signature & Rule Library · Signature Categories
• Event Logs · The Filterable Information
• Dashboard · Detected Attacks by Category

Related questions

• Which attack categories do the signatures cover?
• What is SQL Injection?
• What are LFI and RFI (Local / Remote File Inclusion) attacks?