T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/merge.sh:28- Finding
FFconcat Directive Injection Through Unescaped Filenames
- Content
View full analysis
> "$TEMP_LIST" done ffmpeg -f concat -safe 0 -i "$TEMP_LIST" -c copy -y "$OUTPUT" ``` ### Technical Analysis The script embeds each command-line filename directly into an FFconcat control file. Although `"$f"` is protected from shell word splitting, it is not escaped for the FFconcat syntax being generated. A filename containing a single quote, carriage return, or newline can terminate the intended `file` directive and introduce additional directives. The use of `-safe 0` also disables FFmpeg's safe-filename restrictions, increasing the range of paths that injected directives may reference. The temporary file itself is created securely with `mktemp`; however, it contains attacker-influenced control syntax rather than plain opaque data. ### Attack Path 1. An attacker obtains control over one or more filenames passed to `merge.sh`, such as through uploaded media, an automated processing queue, or an untrusted caller. 2. The attacker supplies an argument containing quote and newline characters structured as FFconcat directives. 3. The loop writes that argument into the temporary list without FFconcat-specific escaping or control-character rejection. 4. `ffmpeg` parses the injected text as additional concat-demuxer directives. 5. FFmpeg attempts to process an unintended local media file or another resource accepted by the active FFmpeg configuration. Successful exploitation depends on the injected resource being accessible and usable by FFmpeg. ### Impact Assessment The injected directives execute with the same operating-system identity and filesystem permissions as the script. This does not independently provide privilege escalation, but it may allow an attacker to: - Cause ...[truncated 475 chars]- Remediation
View remediation