1

A web scan by ZAP indicated that my website is vulnerable to a Remote OS command injection. Details are below:

This is the URL the scanner found vulnerable:

https://[redacted]/[redacted]?address=ZAP%22%26sleep+15%26%22&email=foo-bar%40example.com&message=&name=ZAP&phone=9999999999

This is the exploit:

ZAP"&sleep 15&"

Is this considered a true exploit or just a false positive?

Improve this question
2
  • What happens when you visit the url?
    – nobody
    Dec 17, 2020 at 6:15
  • Nothing happened.
    – sanba06c
    Dec 17, 2020 at 6:24

1 Answer 1

Reset to default
3

In my case every time I see this vulnerability it is false positive, this command is "sleep", so if the response long, and takes approximately 15 seconds, which can happen for various reasons (network problems, VPN problems) OWASP ZAP return this as vulnerability.

You should run this request several times and see if every response takes approximately 15 seconds, if not, I would classify this as false positive.

Improve this answer
1
  • According to my reading of the source code for this part of the scanner at github.com/zaproxy/zap-extensions/blob/main/addOns/ascanrules/… , the vulnerability will be found even if the web page simply returns the "command string" back in the HTML. This will obviously cause a huge number of false positives, as it in no way proves that the command was actually executed by the OS.
    – Jordan Rieger
    Feb 6 at 22:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .