T09 · Insecure Skill Coding Practices
Error
- Location
scripts/render-elk.mjs:273- Finding
Shell Command Injection During PNG Conversion
- Content
View full analysis
/dev/null`); console.log(` ✅ ${file} → svg/${svgName} + svg/${pngName}`); } catch { console.log(` ✅ ${file} → svg/${svgName} (PNG conversion failed — sips not available?)`); } } ``` ### Technical Analysis The script constructs a shell command by interpolating the user-selected directory and discovered JSON filename into a string passed to `execSync`. Node.js executes this string through a shell. Although the paths are surrounded by double quotes, double quotes do not suppress shell command substitution such as `$(...)`. Embedded quotes can also terminate the intended quoted argument. Consequently, a malicious directory name or `.json` filename containing shell metacharacters can cause arbitrary commands to be evaluated. The `.json` filename filter does not prevent exploitation because a malicious filename can contain shell syntax while still ending in `.json`. The broad `catch` block may also obscure exploitation by reporting a normal PNG conversion failure after the injected command has run. ### Attack Path 1. An attacker creates or supplies a diagram directory containing a valid JSON file whose filename includes shell command-substitution syntax and ends in `.json`. 2. A user runs the documented batch conversion command with PNG generation enabled: ```bash node scripts/render-elk.mjs --dir --png ``` 3. The malicious filename is used to construct `svgName` and `pngName`. 4. The interpolated command is passed to `execSync`. 5. The shell evaluates the attacker-controlled syntax before invoking `sips`. 6. The injected command exe ...[truncated 529 chars]- Remediation
View remediation