7

I am using Process.Start in a Windows Service I created to execute an exe that I have on my server that is used for audio conversion. I am passing some user input as a parameter to this exe. The code looks something like this:

string filePath = "\ffmpeg.exe";
string parameters =  String.Format(@"-i ""{0}"" -f mp3 ""{1}""", 
                           LocalFileName,
                           tempDirectory + NewFileName);
ProcessStartInfo startInfo = new ProcessStartInfo(ffmpegPath, parameters);
Process proc = Process.Start(startInfo);

The variables LocalFileName and NewFileName are set from user input. If I want to protect against OS Injection, is it sufficient to strip out any & characters or is there more that I should be doing?

9
  • How is an attack possible if you are giving only filenames as parameters? I don't think you should validate c# against problems similar to sql injection
    – techno
    Commented May 9, 2014 at 3:11
  • 1
    My concern is that a file could be named something like: test & timeout 1000 Commented May 9, 2014 at 5:21
  • But you are the owner of the process and you decide what the process does.How can a process execute command lines passed to it as filename parameters
    – techno
    Commented May 9, 2014 at 6:51
  • Using & as I mentioned above... Are you saying this isn't possible? Just to clarify - you do know what & does in the Windows command prompt correct? Commented May 9, 2014 at 15:27
  • well what does it do? :),want to see your view
    – techno
    Commented May 9, 2014 at 15:46

2 Answers 2

4

Extra arguments into the parameters Strip any quotes from your string to ensure they can't throw in there own arguments into the command-line.

Eat your disk space Strip out ./\ characters. As if you don't you'll get an attack like "\Windows\Filename" would actually write file to ":\Windows\TempDirName\Filename" and when you later need to clean your temp files the attackers file will be in different location than you'll be looking to clean.

E.g. You'll be looking at "C:\AudioConversion\Temp\" When attackers file will be at: "C:\Windows\Temp\"

Does ffmpeg.exe have any vulnerabilities in version your using? Have a look at penetration websites for any vulnerabilities against this tool. If you're familiar with this process ofcourse give it ago yourself for extra safety. You could enable DEP for this process if you're paranoid.

Buffer overflows in your program? Yes, highly unlikely unless you're using unsafe modifier or making native calls etc but do review it.

1

You're starting the process with parameters, not submitting a command line. Using Process.Start is like running parameterized SQL.

1
  • 1
    He should also make sure the closing quotes cannot be escaped ("{0}" by a ") in the LocalFileName variable. I'm not sure if this refers to a valid file-system file or a user set value though. Commented May 9, 2014 at 8:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .