Fix Command Injection in Beego
Command Injection in Beego frameworks occurs when untrusted user input is passed directly to system execution primitives like 'os/exec' without sanitization or proper argument separation. Attackers exploit this by injecting shell metacharacters (e.g., ';', '&&', '|') to break the command context and achieve Remote Code Execution (RCE) on the host.
The Vulnerable Pattern
package controllersimport ( “github.com/beego/beego/v2/server/web” “os/exec” )
type ExploitController struct{ web.Controller }
func (c *ExploitController) Get() { // VULNERABLE: Input from ‘host’ parameter is concatenated into a shell command host := c.GetString(“host”) cmd := exec.Command(“bash”, “-c”, “ping -c 1 ” + host) out, _ := cmd.CombinedOutput() c.Ctx.WriteString(string(out)) }
The Secure Implementation
The vulnerability lies in using 'bash -c' with string concatenation, which invokes a shell interpreter. The fix involves two primary defenses: First, utilize 'exec.Command' by passing the executable and its arguments as distinct strings; this prevents the operating system from parsing the input as shell commands. Second, implement strict allow-listing or type validation (e.g., net.ParseIP) to ensure the input conforms exactly to expected formats before it ever touches the execution layer.
package controllersimport ( “github.com/beego/beego/v2/server/web” “os/exec” “net” )
type SecureController struct{ web.Controller }
func (c *SecureController) Get() { host := c.GetString(“host”)
// 1. Strict Input Validation: Ensure 'host' is a valid IP/Hostname if net.ParseIP(host) == nil { c.Ctx.Output.SetStatus(400) c.Ctx.WriteString("Invalid Input") return } // 2. Avoid Shell Interpolation: Pass arguments as separate slices // This prevents the shell from interpreting metacharacters cmd := exec.Command("ping", "-c", "1", host) out, _ := cmd.CombinedOutput() c.Ctx.WriteString(string(out))
}
Your Beego API
might be exposed to Command Injection
74% of Beego apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.