T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:134- Finding
Command Execution Through sed Program Injection in Configuration Updates
- Content
View full analysis
)"; fi elif [ -z "$val" ]; then grep "^${key}=" "$cfg" 2>/dev/null | cut -d= -f2- || echo "(not set)" else if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi echo "Set: $key=$val" fi } ``` ### Technical Analysis Both `key` and `val` are inserted directly into a dynamically constructed sed program. The script applies no validation or escaping for sed delimiters, regular-expression operators, replacement metacharacters, or newline characters. In the update branch, a crafted value can terminate the intended substitution and append another sed command. On GNU sed, the `e` command can execute an external shell command. A multiline argument can therefore transform the generated sed expression into a program containing an attacker-selected command. The same unescaped key is also interpreted as a regular expression by `grep` and sed, which can cause unintended configuration entries to be selected or modified. ### Attack Path 1. The attacker causes a configuration key, such as `foo`, to exist in `config.txt`. 2. The attacker supplies `config foo` with a crafted multiline value containing the sed delimiter, a newline, and a GNU sed `e` command. 3. The existing-key check succeeds, and the script interpolates the value into: ```bash sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" ``` 4. The injected delimite ...[truncated 642 chars]- Remediation
View remediation