How to fix Command Injection
in ServiceStack
Executive Summary
Command Injection in ServiceStack services occurs when untrusted DTO properties are concatenated into system shell commands. This bypasses application logic to execute arbitrary code on the underlying OS. As a Senior AppSec Researcher, I see this most often when devs use Process.Start with shell execution enabled or string-formatted arguments. The fix is simple: kill the shell, use ArgumentList, and enforce strict input validation.
The Vulnerable Pattern
public class ExecuteDiagnostic : IReturn{ public string Target { get; set; } }
public class DiagnosticService : Service { public object Any(ExecuteDiagnostic request) { // CRITICAL VULNERABILITY: String concatenation into a shell command // Payload: ‘127.0.0.1; cat /etc/passwd’ var process = new Process { StartInfo = new ProcessStartInfo { FileName = “/bin/bash”, Arguments = $“-c “ping -c 1 {request.Target}"", RedirectStandardOutput = true, UseShellExecute = false } }; process.Start(); return process.StandardOutput.ReadToEnd(); } }
The Secure Implementation
The vulnerability stems from the use of '/bin/bash -c' with string interpolation, which allows an attacker to break out of the intended command using semicolons, backticks, or pipes. The secure implementation mitigates this by: 1. Validating the input against a strict format (IPAddress) before processing. 2. Using the 'ArgumentList' property available in .NET Core/5+, which passes arguments directly to the execve system call without invoking a shell. This ensures the input is treated as a literal string argument rather than executable code.
public class ExecuteDiagnostic : IReturn{ public string Target { get; set; } } public class DiagnosticService : Service { public object Any(ExecuteDiagnostic request) { // 1. Strict Whitelisting/Validation if (!System.Net.IPAddress.TryParse(request.Target, out _)) throw new HttpError(System.Net.HttpStatusCode.BadRequest, “Invalid target format.”);
// 2. Use ArgumentList to prevent shell metacharacter interpretation var startInfo = new ProcessStartInfo("ping") { ArgumentList = { "-c", "1", request.Target }, RedirectStandardOutput = true, UseShellExecute = false, CreateNoWindow = true }; using var process = Process.Start(startInfo); return process.StandardOutput.ReadToEnd(); }
}
Your ServiceStack API
might be exposed to Command Injection
74% of ServiceStack apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.