GuardAPI Logo
GuardAPI

Fix Command Injection in Iris

Command injection in Iris occurs when untrusted user input is concatenated directly into a system shell command. This allows an attacker to execute arbitrary OS commands with the privileges of the application process. To secure the app, you must stop using shell-spawning functions with raw input and switch to parameterized execution.

The Vulnerable Pattern

package main

import (
“github.com/kataras/iris/v12”
“os/exec”
)


func main() {
app := iris.New()
app.Get(“/lookup”, func(ctx iris.Context) {
target := ctx.URLParam(“host”)
// VULNERABLE: Direct concatenation into a shell string
cmd := exec.Command(“sh”, “-c”, “nslookup “+target)
out, _ := cmd.CombinedOutput()
ctx.Write(out)
})
app.Listen(“:8080”)
}

The Secure Implementation

The vulnerable code uses 'sh -c', which invokes a shell to interpret the command string. An attacker could pass 'google.com; cat /etc/passwd' to execute secondary commands. The secure version removes the shell wrapper and passes the input as a direct argument to the binary. In Go, exec.Command(prog, args...) treats arguments as literal strings, preventing shell metacharacter interpretation. Additionally, a regex whitelist ensures only expected characters reach the logic.

package main

import (
“github.com/kataras/iris/v12”
“os/exec”
“regexp”
)


func main() {
app := iris.New()
app.Get(“/lookup”, func(ctx iris.Context) {
target := ctx.URLParam(“host”)


	// SECURE: Validate input against a strict whitelist (e.g., valid hostname/IP)
	if match, _ := regexp.MatchString("^[a-zA-Z0-9.-]+$", target); !match {
		ctx.StatusCode(400)
		ctx.WriteString("Invalid Input")
		return
	}

	// SECURE: Use parameterized arguments. exec.Command handles escaping.
	cmd := exec.Command("nslookup", target)
	out, err := cmd.CombinedOutput()
	if err != nil {
		ctx.StatusCode(500)
		return
	}
	ctx.Write(out)
})
app.Listen(":8080")


}

System Alert • ID: 8760
Target: Iris API
Potential Vulnerability

Your Iris API might be exposed to Command Injection

74% of Iris apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.

RUN FREE SECURITY DIAGNOSTIC
GuardLabs Engine: ONLINE

Free Tier • No Credit Card • Instant Report

Verified by Ghost Labs Security Team

This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.

About GuardLabs → Follow us on X