T09 · Insecure Skill Coding Practices
Error
- Location
scripts/dt_helper.sh:84- Finding
Command Injection Through Unescaped Configuration Values
- Content
View full analysis
/dev/null; then sed -i "s|^${key}=.*|${key}=${value}|" "$CONFIG" else echo "${key}=${value}" >> "$CONFIG" fi } ``` The untrusted values are supplied by the following command handler: ```bash cmd_set() { local kv="$1" if [ -z "$kv" ] || [[ "$kv" != *"="* ]]; then echo "❌ 格式错误，用法: --set KEY=VALUE" >&2 exit 1 fi local key="${kv%%=*}" local value="${kv#*=}" cfg_set "$key" "$value" echo "✅ 已设置 ${key}" } ``` ### Technical Analysis Both `key` and `value` originate from the command-line argument passed to `--set`. They are embedded directly into a GNU `sed` program without escaping regular-expression metacharacters, replacement metacharacters, delimiters, newlines, or command flags. When a configuration key already exists, a value containing the `|` delimiter can terminate the replacement expression and introduce the GNU `sed` `e` flag. The `e` flag executes the substituted pattern space as a shell command. For example, a value shaped like: ```text $(attacker-command)|e ``` can cause the generated expression to resemble: ```bash sed -i 's|^EXISTING_KEY=.*|EXISTING_KEY=$(attacker-command)|e' "$CONFIG" ``` GNU `sed` then evaluates the replacement result through a shell, causing the injected command substitution to execute. Unvalidated keys also permit regular-expression manipulation and configuration-file corruption. ### Attack Path 1. An attacker identifies or predicts a configuration key that already exists. 2. The attacker convinces the user or an Agent workflow to invoke `dt_helper.sh --set` with a cr ...[truncated 863 chars]- Remediation
View remediation