Fix Command Injection in Falcon
Command injection in Falcon occurs when untrusted data from request parameters or bodies is passed directly to system shells. This typically happens via functions like os.system, os.popen, or subprocess.Popen with shell=True. Attackers exploit this by injecting shell metacharacters (e.g., ;, |, &&) to execute arbitrary code with the privileges of the API process.
The Vulnerable Pattern
import falcon import os
class DiagnosticResource: def on_get(self, req, resp): # VULNERABLE: User input from query param is passed directly to os.system target_host = req.get_param(‘host’) command = f’ping -c 1 {target_host}’ os.system(command) resp.media = {‘status’: ‘executed’}
The Secure Implementation
To remediate command injection, never invoke the system shell. The fix involves two layers of defense: First, replace os.system with the subprocess module using a list of arguments and shell=False. This ensures the OS treats the input as a literal string rather than a command to be parsed by /bin/sh. Second, implement strict input validation using regex to ensure the input matches expected formats (e.g., an IP address or a hostname), preventing unexpected characters from ever reaching the execution sink.
import falcon
import subprocess
import re
class DiagnosticResource:
def on_get(self, req, resp):
target_host = req.get_param(‘host’)
# 1. Strict Input Validation (Allow-list approach)
if not target_host or not re.match(r'^[a-zA-Z0-9.-]+$', target_host):
raise falcon.HTTPBadRequest(title='Invalid Host')
# 2. SECURE: Use subprocess.run with shell=False and pass arguments as a list
try:
result = subprocess.run(
['ping', '-c', '1', target_host],
capture_output=True,
text=True,
shell=False, # Explicitly disable shell
timeout=5
)
resp.media = {'output': result.stdout}
except subprocess.CalledProcessError as e:
resp.status = falcon.HTTP_500
resp.media = {'error': str(e)}</code></pre>
Your Falcon API
might be exposed to Command Injection
74% of Falcon apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.