Fix Command Injection in Phalcon

Command injection in Phalcon occurs when untrusted user input is passed directly to system-level execution functions without strict validation or escaping. This allows an attacker to break out of the intended command and execute arbitrary code on the underlying OS, leading to full server compromise. As a Senior AppSec Researcher, I see this most often when developers try to wrap system utilities like 'ping', 'sendmail', or image processing binaries.

The Vulnerable Pattern

public function checkHostAction() {
    // DANGER: Taking raw POST data from the Phalcon request object
    $target = $this->request->getPost('hostname');
// VULNERABLE: Direct concatenation into shell_exec
// An attacker could send: 'google.com; cat /etc/passwd'
$result = shell_exec('ping -c 1 ' . $target);

return $this->response->setContent($result);
}

The Secure Implementation

The vulnerability stems from the shell interpreting characters like ';', '&', '|', and backticks as command separators. In the secure version, we implement two layers of defense. First, we use 'filter_var' to ensure the input strictly matches a hostname format, rejecting any malicious payloads early. Second, we use 'escapeshellarg()', which adds single quotes around the string and escapes any existing single quotes. This ensures the shell treats the input as a single literal argument rather than part of the command structure. For maximum security, always prefer native PHP extensions (like 'curl' or 'sockets') over 'shell_exec' to avoid the shell environment entirely.

public function checkHostAction() {
    $target = $this->request->getPost('hostname');
// FIX 1: Strict Validation (Whitelist/Regex)
if (!filter_var($target, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME)) {
    return $this->response->setStatusCode(400, 'Invalid Hostname');
}

// FIX 2: Use escapeshellarg to neutralize shell metacharacters
$safeTarget = escapeshellarg($target);

// Execute using the sanitized argument
$result = shell_exec('ping -c 1 ' . $safeTarget);

return $this->response->setContent(htmlspecialchars($result));
}