Skip to content

Latest commit

 

History

History
18 lines (13 loc) · 499 Bytes

Exec_Code1.java.md

File metadata and controls

18 lines (13 loc) · 499 Bytes
Raw

Question

What is the problem here?

public static void main(String[] args) throws Exception {
    System.out.println("The folder name you want to create is: " + args[0]);
    String folderName = args[0];
    String cmd = "mkdir " + folderName;
    Runtime.getRuntime().exec(cmd);
}

-----SPLIT-----

Answer

It is a Code Execution issue. 'folderName' parameter is vulnerable to OS command injection attacks. An intruder can supply 'FolderName; id' input to run consecutive commands.