T09 · Insecure Skill Coding Practices
Error
- Location
pipeline-cli.yaml:22- Finding
Arbitrary Command Execution Through Unsanitized Host Input
- Content
View full analysis
/dev/null | openssl x509 -noout -text -dates -fingerprint -sha256 2>/dev/null || echo "CONNECTION_FAILED" ``` ### Technical Analysis The pipeline reads an arbitrary line from standard input and stores it in `meta host` without syntactic validation. The value is subsequently interpolated into a command string passed to `sh -c`. Quoting interpolated input with double quotes does not reliably prevent command injection because shell substitutions embedded in the rendered string, such as command substitutions, are interpreted when `sh` parses the final command. An attacker can therefore supply shell syntax instead of a valid hostname. Using `sh -c` unnecessarily introduces a shell interpreter into a workflow that only needs to invoke OpenSSL with fixed arguments. ### Attack Path 1. An attacker supplies a crafted host value through the CLI pipeline's standard input. 2. The mapping processor stores the value unchanged in `meta host` and `host_with_port`. 3. Template interpolation inserts the attacker-controlled value into the shell program. 4. The `command` processor invokes `sh -c`. 5. The shell evaluates injected syntax, such as command substitution, while processing the OpenSSL command. 6. The attacker's co ...[truncated 964 chars]- Remediation
View remediation