Command Injection in Adonisjs

Command injection in Adonisjs applications typically occurs when user input is directly passed to Node.js child process functions without proper sanitization. The vulnerability manifests through several Adonisjs-specific patterns:

// Vulnerable Adonisjs controller action
const { exec } = require('child_process');

class FileController {
  async convertFile({ request }) {
    const format = request.input('format');
      if (err) return console.error(err);
      return stdout;
    });
  }
}

The above pattern is dangerous because the format parameter flows directly into the shell command. An attacker could supply jpg; rm -rf / or similar payloads. Adonisjs's dynamic routing and parameter handling makes this particularly risky when route parameters are used:

// Route: Route.get('/process/:command', 'ProcessController.execute')
class ProcessController {
  async execute({ params }) {
    });
  }
}

Another common Adonisjs-specific pattern involves using the filesystem with user input:

const fs = require('fs');
const { exec } = require('child_process');

class SystemController {
  async runDiagnostics({ request }) {
    });
  }
}

Adonisjs developers often use the await pattern with child processes, which can mask the vulnerability:

const { exec } = require('child_process');

class ReportController {
  async generateReport({ request }) {
  }
}

The exec function is particularly dangerous because it spawns a shell, allowing command chaining, environment variable access, and file redirection operators. Adonisjs's permissive routing and middleware system means these vulnerabilities can exist anywhere in the application stack.

Detecting command injection in Adonisjs applications requires both static code analysis and runtime scanning. Static analysis should focus on Adonisjs-specific patterns:

# Search for dangerous patterns in Adonisjs controllers
grep -r "exec(" app/Controllers/**
grep -r "child_process" app/Controllers/**
grep -r "spawn(" app/Controllers/**

Dynamic scanning with middleBrick specifically tests Adonisjs applications by:

• Scanning all API endpoints for command injection patterns
• Testing parameter handling in Adonisjs route definitions
• Checking for unsafe child process usage in controller actions
• Verifying proper input validation on user-supplied parameters

middleBrick's black-box scanning approach is particularly effective for Adonisjs applications because it tests the actual running API without requiring source code access. The scanner sends payloads to detect command injection vulnerabilities:

// Example payload sent by middleBrick scanner
{
  "format": "jpg; cat /etc/passwd",r>  "command": "id; whoami",r>  "diagnostic_tool": "malicious; echo hacked"r>}

Adonisjs developers should also monitor application logs for signs of attempted command injection:

# Monitor for suspicious patterns in Adonisjs logs
tail -f storage/logs/*.log | grep -E "(exec|spawn|rm|cat|id|whoami)"

middleBrick provides specific findings for Adonisjs applications, including:

• Command injection in controller actions
• Unsafe parameter handling in route definitions
• Missing input validation on user parameters
• Improper use of child process functions

The scanner's 5-15 second scan time makes it practical to run middleBrick as part of your development workflow, catching these vulnerabilities before they reach production.

Remediating command injection in Adonisjs requires a defense-in-depth approach. The primary strategy is to eliminate shell command execution entirely when possible:

// Instead of using exec with user input
// Use Node.js native APIs
const fs = require('fs');
const path = require('path');

class FileController {
  async convertFile({ request }) {
}

When shell commands are unavoidable, use spawn with arrays instead of exec with strings:

const { spawn } = require('child_process');

class ProcessController {
  async execute({ request }) {
}

Adonisjs provides validation helpers that should be used for all user input:

const { validate } = use('Validator');

class SecureController {
  async runCommand({ request, response }) {
}

For file operations, use path validation to prevent directory traversal combined with command injection:

const path = require('path');

class FileController {
  async processFile({ request }) {
}

middleBrick's continuous monitoring in Pro plans can help verify that these remediations remain effective as your Adonisjs application evolves.