Fix Command Injection in Hug

In the context of the Hug framework, command injection typically arises when user-controlled parameters are passed directly to shell-executing functions like os.system, os.popen, or subprocess.run with shell=True. This allows an attacker to break out of the intended command using shell metacharacters (e.g., ;, |, &&) to execute arbitrary code with the privileges of the API process.

The Vulnerable Pattern

import hug
import os
@hug.get(‘/lookup’)
def nslookup(domain: hug.types.text):
# CRITICAL VULNERABILITY: String formatting into a shell command
# Attacker can pass: ‘google.com; cat /etc/passwd’
command = f’nslookup {domain}’
return os.popen(command).read()

The Secure Implementation

The vulnerable implementation utilizes a shell-aware sink (os.popen) where the input is interpreted by /bin/sh. By injecting shell delimiters, an attacker gains Remote Code Execution (RCE). The secure version eliminates the shell intermediary by passing a list of arguments directly to the executable. This ensures that even if the input contains characters like semicolons or backticks, they are treated as literal data by the nslookup binary rather than instructions for the shell. Always avoid shell=True and prefer native Python libraries over system calls whenever possible.

import hug
import subprocess
import shlex
@hug.get(‘/lookup’)
def nslookup(domain: hug.types.text):
# REMEDIATION: Use subprocess with argument lists and shell=False
# This treats the input as a single literal argument, not a shell command
try:
result = subprocess.run(
[‘nslookup’, domain],
capture_output=True,
text=True,
check=True,
timeout=5
)
return result.stdout
except subprocess.CalledProcessError as e:
return {‘error’: ‘Lookup failed’, ‘details’: e.stderr}
except subprocess.TimeoutExpired:
return {‘error’: ‘Command timed out’}