Fix Command Injection in Vert.x
Command Injection in Vert.x applications is a critical RCE vector. It typically occurs when a developer sinks unsanitized routing context parameters directly into a system shell via Java's Runtime or ProcessBuilder. In a reactive stack, this allows an attacker to break out of the event loop and execute arbitrary binaries on the host OS.
The Vulnerable Pattern
router.get("/api/check-host").handler(ctx -> {
String hostname = ctx.request().getParam("host");
try {
// CRITICAL VULNERABILITY: String concatenation allows shell metacharacters (e.g., ; rm -rf /)
Runtime.getRuntime().exec("nslookup " + hostname);
ctx.response().end("Lookup initiated");
} catch (Exception e) {
ctx.fail(500);
}
});The Secure Implementation
The exploit works because shells like /bin/sh interpret characters like ';', '&', and '|' as command separators. To fix this, first implement a strict regex-based allowlist to ensure the input matches expected formats. Second, never pass a single concatenated string to exec(). Instead, use ProcessBuilder with a List or Array of arguments. This forces the operating system to treat the user input as a literal data argument rather than an executable instruction, effectively neutralizing command injection.
router.get("/api/check-host").handler(ctx -> { String hostname = ctx.request().getParam("host");// 1. Strict Allowlist Validation if (hostname == null || !hostname.matches("^[a-zA-Z0-9.-]+$")) { ctx.response().setStatusCode(400).end("Invalid Hostname"); return; } // 2. Use ProcessBuilder with an argument array to avoid shell interpretation ProcessBuilder pb = new ProcessBuilder("nslookup", hostname); try { pb.start(); ctx.response().end("Lookup initiated safely"); } catch (IOException e) { ctx.fail(500); }
});
Your Vert.x API
might be exposed to Command Injection
74% of Vert.x apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.