Fix Command Injection in Nitro
Nitro's server routes are a high-value target for Remote Code Execution (RCE). When developers pipe untrusted input from 'getQuery' or 'readBody' directly into Node's 'child_process' modules without strict sanitization, they grant attackers shell access. To secure a Nitro backend, you must eliminate shell interpretation by avoiding 'exec' and enforcing strict argument separation.
The Vulnerable Pattern
import { execSync } from 'node:child_process';
export default defineEventHandler((event) => { const { domain } = getQuery(event); // VULNERABLE: Direct string interpolation into a shell-aware function // Attacker can pass: ?domain=google.com; cat /etc/passwd const result = execSync(nslookup ${domain}); return { output: result.toString() }; });
The Secure Implementation
The vulnerability stems from 'execSync' spawning a shell (/bin/sh or cmd.exe) to parse the command string, allowing metacharacters like semicolons or pipes to trigger secondary commands. The fix involves two layers: First, strict Regex validation to ensure the input matches expected patterns. Second, switching to 'spawnSync' with the arguments passed as an array. This forces the OS to treat the input as a literal string argument for the binary rather than a command to be interpreted by a shell environment.
import { spawnSync } from 'node:child_process';export default defineEventHandler((event) => { const { domain } = getQuery(event);
// 1. Input Validation: Only allow expected characters if (!domain || typeof domain !== ‘string’ || !/^[a-zA-Z0-9.-]+$/.test(domain)) { throw createError({ statusCode: 400, statusMessage: ‘Invalid Input’ }); }
// 2. SECURE: Use spawnSync with an arguments array to bypass shell execution const { stdout, stderr, error } = spawnSync(‘nslookup’, [domain], { encoding: ‘utf-8’, timeout: 5000, shell: false // Explicitly disable shell });
if (error) return { error: ‘Execution failed’ }; return { output: stdout || stderr }; });
Your Nitro API
might be exposed to Command Injection
74% of Nitro apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.