T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:133- Finding
Arbitrary Command Execution Through Configuration Value Injection
- Content
View full analysis
)"; fi elif [ -z "$val" ]; then grep "^${key}=" "$cfg" 2>/dev/null | cut -d= -f2- || echo "(not set)" else if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi echo "Set: $key=$val" fi } ``` ### Technical Analysis The `key` and `val` command-line arguments are inserted directly into a double-quoted GNU `sed` program: ```bash sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" ``` Shell quoting prevents ordinary shell metacharacters in these variables from being re-evaluated directly by Bash, but it does not make them safe as `sed` program syntax. An attacker can place delimiter characters, backslashes, or literal newline characters in the value. A newline can terminate the intended substitution and introduce an additional GNU `sed` command. In particular, GNU `sed` supports the `e` command, which executes an operating-system command. A crafted multiline value can therefore close the substitution and add a standalone `e ` instruction. The vulnerable branch is reached when the supplied key already exists in `config.txt`. The key is also interpreted as an unescaped regular expression by both `grep` and `sed`, allowing unexpected matching and configuration modification even when command execution is not attempted. ### Attack Path 1. The attacker invokes ...[truncated 1386 chars]- Remediation
View remediation