T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:138- Finding
Arbitrary Command Execution Through Unsafe Configuration Editing
- Content
View full analysis
/dev/null | cut -d= -f2- || echo "(not set)" else if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi echo "Set: $key=$val" fi ``` ### Technical Analysis Both `key` and `val` originate from command-line arguments and are inserted directly into a GNU `sed` program. The implementation does not escape regular-expression metacharacters in `key` or replacement, delimiter, newline, and command metacharacters in `val`. GNU `sed` supports the `e` substitution flag, which executes the resulting pattern space through a shell. A crafted value containing a delimiter, an `e` flag, and a newline can terminate the intended substitution and introduce another `sed` instruction. An attacker can also select a crafted key so that the replacement text becomes a valid shell command followed by a comment. The same unescaped key is used in `grep` as a regular expression, which can cause incorrect key matching, although command execution occurs at the `sed` sink. ### Attack Path 1. The attacker invokes `config` with a crafted key to create a matching line in `config.txt`. 2. The attacker invokes `config` again for that key, supplying a value containing `sed` delimiters, an `e` flag, and a newline. 3. The interpolated input changes the effective `sed` program instead of remaining ordinary replacement data. 4. GNU `sed` processes the injected `e` flag. 5. The generated replacement text is passed to `/bin/sh`. 6. The injected shell command executes with the privileges of the user or agent running the Skill. Exploitation requires the ability to invoke the Skill with attacker-controlle ...[truncated 548 chars]- Remediation
View remediation