Home / Knowledge hub / Wildcard injection
Knowledge hub
Wildcard injection
Filenames with special characters that change what a command does to them.
What it means
Many scripts run a command over a whole folder using a wildcard such as *. Before the command starts, the shell replaces the star with a list of the filenames in that folder. Wildcard injection means planting files whose names look like command options, so the command reads the filename as an instruction.
A file called -rf, or one named like a command-line flag, is just a file to the person who uploaded it. Once the shell expands the star, the command cannot tell the difference between its real options and the names it was handed. It is a case of untrusted input ending up where only trusted instructions belong.
Why it matters
The effect depends on the command, but some tools have options that run other programs or delete data. A backup job that archives a folder of uploads, or a cleanup task run as a privileged user, can be steered into running attacker-chosen commands. That means a low-level upload can become control over the server.
It is a quiet cousin of command injection. Nothing is added to the command line by hand; the filenames do the work, which is why code reviews and scanners often miss it. Because the trigger is a harmless-looking file, nobody thinks to look for it in a review.
How it shows up
You meet it in maintenance scripts, cron jobs, deployment steps and backup tasks that run over folders where users or other services can create files. Upload directories, shared temp folders and mounted volumes are the usual places. Any folder that outsiders can write to deserves a second look.
Avoid running broad wildcards over folders that outsiders can write to. Put -- before the file list so options end there, or use ./* instead of *. Better still, pass explicit file lists, run jobs as a user with little power, and validate filenames on upload so names starting with a dash are refused.
Questions people ask
Wildcard injection, answered
What does the double dash do?
In most command-line tools, a lone -- means that no more options follow, so anything after it is treated as a filename. It stops a file named like a flag from being read as one.
Not every tool honours it, so check each.
Is this only a Linux problem?
The best known cases involve Unix shells, which expand the star before the command starts. Other platforms have their own versions of the idea, where input is read as options or patterns.
The root cause is mixing data and instructions.
How is it different from command injection?
In command injection the attacker types extra command text into a field that is put on the command line. In wildcard injection the attacker only controls filenames, and the shell does the rest.
The fix differs, too.
Can validation of uploaded names stop it?
It helps. Refusing names that start with a dash and limiting characters removes the easiest cases. Safer still is to store files under names you generate yourself.
Do both the script fix and the upload fix.
How do we find it?
Read maintenance and deploy scripts for wildcards used on writable folders, then try harmless option-like filenames in a test environment and see whether the tool reacts.
This is much easier with the code in hand.
Sources
Where this comes from
Related
Terms that sit next to this one
Command injection
Input that ends up run as an operating system command on your server.
Injection
Input that ends up running as a command instead of being read as text.
File upload vulnerability
An upload feature that accepts files it should refuse, such as scripts.
Least privilege
Giving every person and service the minimum access the job requires.
Untrusted input
Anything that arrived from outside your own code, and is therefore suspect.
Who gets to name the files?
In white-box mode we read your scripts and jobs, then try harmless option-like filenames on the running app, and report only what ran. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.