The new diagnostics tool runs the check in the background and never shows you any output. But it writes to a diagnostics log you can view. Injection is still possible, but you do not see your command’s result directly.
A background diagnostics tool runs ping and returns no output to you — blind injection. But there is a readable diagnostics log at /var/log/diag.log, and you can redirect your command output into it.
Read the flag secret even though the tool shows no output (blind injection).
In a blind injection you wrote the secret into the log and then read it.
Why the solution worked
Blind injection: the command runs but its output is not shown, so the attacker extracts the result through a side channel — writing it to a file they can read, a time delay (sleep), or an outbound request. The absence of output is not protection. The fix is the same: do not go through a shell (execFile) so injection cannot happen, and isolate the service with least privilege so that even if something slips, the harm is limited.
The root cause
No output does not close the hole: the command still runs, and its result can be redirected somewhere readable later. The root is still command injection into the shell.
How the code is fixed
Hiding output does not prevent injection; a side channel is enough for the attacker. The fix is removing the shell, not hiding the result.
Vulnerable code
app.post('/diag', (req, res) => {
exec('ping -c 1 ' + req.body.host); // runs it, returns nothing — still injectable
res.json({ queued: true });
});
Safe code
app.post('/diag', (req, res) => {
if (!/^[a-z0-9.-]+$/i.test(req.body.host)) return res.status(400).end();
execFile('ping', ['-c', '1', req.body.host]); // array args, no shell
res.json({ queued: true });
});
Impact in the real world
Blind injection exfiltrates data through a side channel — a log, an outbound request, or a time delay — and is common in background tools and async processing.
How defenders detect it
Defenders watch for unexpected writes to log files and child processes from background jobs, and isolate those jobs with least privilege.
