Injection

Injection is the #1 web vulnerability. An attacker sends malicious input that the application executes as code or commands instead of treating it as plain data.

In serverless applications, injection targets Lambda functions through API Gateway inputs — query parameters, form fields, URL path segments, and HTTP headers. The Lambda function receives these inputs and, if it trusts them blindly, passes them into dangerous operations like HTML rendering, shell commands, or database queries.

What we cover

• Cross-Site Scripting (XSS) — client-side injection where malicious JavaScript runs in a victim’s browser.
• OS Command Injection — server-side injection where user input is passed directly to a system shell, giving the attacker full control of the Lambda execution environment.

Both vulnerabilities exist because the application never validates or sanitizes what the user sends.