# Command injection via logs and config

Untrusted log text or config values reaching shell sinks like system, popen, or maintenance scripts

_Area: Network devices and IoT. Seen in 2 disclosed reports; latest 2026-09-30. Updated 2026-10-24._

## How it works
A device trusts data it wrote itself. An unauthenticated field (User-Agent, login-failure text, a decoded URL path, a config key) is stored in a log file or config store, then a later process — a cron job, a maintenance parser, a helper binary — reads that value and hands it to a shell without quoting or validation. The assumption that breaks is "data in our own log/config is safe." It is not: whoever can write the field controls the shell command. The same break happens when a set-command API maps request body keys straight onto config paths, letting an attacker plant a value that a shell-out sink later consumes [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-getting-shell-tapo-c260-webcam.md).

## Where it shows up
- Maintenance or error-parsing scripts (e.g. Perl/shell helpers) that read log files and call `system`/backticks [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-netscaler-zero-days-exploited.md)
- Any unauthenticated request field that lands in a log: User-Agent, path, login-failure message [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-netscaler-zero-days-exploited.md)
- `popen`/`system` callers whose argument comes from a config value, not the request [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-getting-shell-tapo-c260-webcam.md)
- Set-command handlers that accept arbitrary JSON keys and write them to config paths (mass assignment) [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-getting-shell-tapo-c260-webcam.md)
- URL-decode-then-concatenate path handling before file operations [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-getting-shell-tapo-c260-webcam.md)
- Admin panels where stored XSS can defeat CSRF tokens, exposing a command sink [E3](https://bugbountylibrary.com/r/h1%3A289264.md)

## How to review
Trace every shell sink (`system`, `popen`, `exec`, backticks) back to its data source. The invariant: no value that an unauthenticated or low-privilege user can influence — directly or by writing it into a log/config that a privileged process later reads — may reach a shell unquoted. Check the log-to-parser path explicitly: what writes the log, what reads it, and does the reader escape. For config APIs, confirm request keys are allowlisted, not mapped onto arbitrary paths. For admin UIs, confirm CSRF tokens survive stored XSS.

## Variants seen
- Log poisoning into a root-run maintenance parser [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-netscaler-zero-days-exploited.md)
- Config value (`dev_name`) planted via mass assignment, reaching `popen` for guest RCE [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-getting-shell-tapo-c260-webcam.md)
- Stored XSS defeating CSRF to reach a command injection sink [E3](https://bugbountylibrary.com/r/h1%3A289264.md)

## Impact and severity
Highest seen is unauthenticated root RCE on an internet-facing appliance, enabling web shells and persistence via config edits [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-netscaler-zero-days-exploited.md). Lower-privilege RCE still gives a foothold [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-getting-shell-tapo-c260-webcam.md). Severity rises when the sink runs as root and the input needs no authentication; admin-panel XSS chains are worse when they bypass CSRF entirely [E3](https://bugbountylibrary.com/r/h1%3A289264.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-netscaler-zero-days-exploited.md
- E2: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-getting-shell-tapo-c260-webcam.md
- E3: https://bugbountylibrary.com/r/h1%3A289264.md