The Ravens’ network diagnostics tool runs a ping on the host you type. The server builds the command by pasting your input straight into a shell line, and on the system there is a flag file holding the root secret.
A network diagnostics tool in Ravens Tools takes a hostname and runs ping on it. The server builds the command line by concatenating your input directly, and shows you the line and the output. The filesystem has a flag file with the root secret.
Run an extra command that reads the flag file and shows its content.
You injected an extra command and read the flag file.
Why the solution worked
This is OS command injection: your input entered the shell line as commands, not data, so the semicolon started a new command running with the server’s privileges. The fix: do not build shell commands by pasting text; use an API that passes arguments as a separate array from the command (execFile instead of exec), so there is no shell line to interpret; and if a shell is unavoidable, validate the input against a strict allowlist.
The root cause
The server passes user input to the OS shell inside a concatenated command line, so any command separator injects a new command. The root is passing untrusted data to a shell interpreter.
How the code is fixed
Rule: separate the command from its arguments (an array) and avoid a shell entirely, so there is nothing to interpret the separators.
Vulnerable code
app.post('/ping', (req, res) => {
// Input is concatenated into a shell line: ; | $() all become operators.
exec('ping -c 1 ' + req.body.host, (e, out) => res.send(out));
});
Safe code
app.post('/ping', (req, res) => {
// Arguments are an array; there is no shell to interpret separators.
if (!/^[a-z0-9.-]+$/i.test(req.body.host)) return res.status(400).end();
execFile('ping', ['-c', '1', req.body.host], (e, out) => res.send(out));
});
Impact in the real world
Command injection grants the attacker command execution on the server and is among the most severe bugs, often leading to full system takeover.
How defenders detect it
Defenders watch inputs for shell metacharacters (; | and separators) and monitor for unexpected child processes spawned by the web service.
