Shell Injection Vulnerabilities Lurking in Unix Utilities

Many Unix utilities use the `system(3)` function to execute external commands, leading to potential shell injection vulnerabilities. This article delves into this issue, analyzing the behavior of `system(3)`, `sh -c`, and various tools like `watch`, `ssh`, and `i3`, demonstrating how shell metacharacters can be used to bypass security measures. The author advocates for avoiding `system(3)` and provides mitigation techniques, such as using `exec --` and proper quoting and escaping. Ultimately, the article calls for developers to address these security flaws in their tools.