T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:143- Finding
Command Injection Through Unsafe GNU sed Expression Construction
- Content
View full analysis
/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi ``` ### Technical Analysis The `config` command incorporates the user-controlled `key` and `val` arguments directly into a GNU sed program. Shell quoting prevents ordinary shell expansion at the initial command invocation, but it does not prevent sed metacharacters from changing the structure of the generated sed program. An attacker can introduce delimiter characters, regular-expression metacharacters, backslashes, or embedded newlines. On GNU sed, a crafted expression can introduce an additional command, including the `e` command, which executes text through a shell. The unescaped key can also match or alter configuration entries other than the intended literal key. The vulnerable update branch is reachable when `config.txt` already contains a line matching the supplied key. ### Attack Path 1. The attacker invokes the `config` command to create a configuration entry in `$SLASHING_DIR/config.txt`. 2. The attacker invokes `config` again for an existing key, causing execution to enter the `sed -i` update branch. 3. The attacker supplies a crafted key or value containing sed control syntax, such as a delimiter and an additional GNU sed command. 4. The generated sed program is interpreted rather than treating the arguments as literal configuration data. 5. An injected GNU sed `e` instruction invokes a shell command with the privileges of the user running the Skill. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account that invokes the Skill. The attacker can read or modify files accessible to that account, destroy stored data, execute other install ...[truncated 332 chars]- Remediation
View remediation
&2 return 1 } ``` 2. Replace the sed-based update with a parser that compares keys as literal strings and writes results to a securely created temporary file. 3. Create temporary files inside the destination directory with `mktemp`, set restrictive permissions, and atomically replace the configuration using `mv`. 4. Treat values as opaque data rather than executable syntax. If the text format must be retained, explicitly encode newlines and other control characters. 5. Restrict supported keys to documented configuration options rather than accepting arbitrary names. 6. Add tests covering sed delimiters, newlines, backslashes, regular-expression characters, and GNU sed command syntax. ]]>