T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/track.sh:191
- Finding
- Unvalidated command-line input is interpolated into a signed API request<![CDATA[ ## Vulnerability Details **File Location**: `scripts/track.sh`, lines 191–202 **Vulnerability Type**: Improper input validation and unsafe JSON/form-data construction **Risk Level**: Medium ### Vulnerable Code ```bash PARAM="{\"com\":\"${CARRIER_CODE}\",\"num\":\"${TRACKING_NUM}\",\"resultv2\":\"4\",\"order\":\"desc\"}" # MD5 签名: param + key + customer -> 32位大写MD5 SIGN=$(calc_md5 "${PARAM}${API_KEY}${CUSTOMER}") # ---- 发起查询 ---- echo "📦 正在查询单号: ${TRACKING_NUM}" echo "" RESPONSE=$(curl -s -X POST "https://poll.kuaidi100.com/poll/query.do" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "customer=${CUSTOMER}&sign=${SIGN}¶m=${PARAM}") ``` ### Technical Analysis `CARRIER_CODE` and `TRACKING_NUM` originate from command-line arguments and are inserted directly into a JSON string without JSON encoding or strict validation. Shell quoting prevents these values from being evaluated directly as shell commands, but it does not make them safe for the JSON or form-encoded data layers. Characters such as double quotes, backslashes, control characters, equals signs, and ampersands can break or modify the intended request structure. In particular: - Quotes and backslashes can produce malformed JSON or introduce additional JSON members. - Ampersands can split the raw `curl -d` body into additional form fields because the completed `param` value is not independently URL-encoded. - The resulting attacker-controlled request is signed using the legitimate API key and customer identifier before being submitted to Kuaidi100. The exact interpretation of duplicate or injected fields depends on the remote API parser. Therefore, arbitrary server-side field manipulation is not guaranteed, but malformed requests and signed request tampering are demonstrably possible. ### Attack Path 1. An attacker supplies a crafted tracking number or manually supplied carrier code through a package-tracking request. 2. The agent invokes `scripts/track.sh` with the ...[truncated 1223 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate tracking numbers against a conservative allowlist and length limit appropriate for supported carriers. For example, reject values containing quotes, backslashes, control characters, whitespace, ampersands, or equals signs. 2. Validate manually supplied carrier codes against an explicit list of supported Kuaidi100 carrier identifiers rather than accepting arbitrary strings. 3. Construct the JSON document with a JSON-aware utility: ```bash PARAM=$(jq -cn \ --arg com "$CARRIER_CODE" \ --arg num "$TRACKING_NUM" \ '{com: $com, num: $num, resultv2: "4", order: "desc"}') ``` 4. Have `curl` encode every form field independently: ```bash RESPONSE=$(curl --silent --show-error --fail-with-body \ -X POST "https://poll.kuaidi100.com/poll/query.do" \ -H "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "customer=${CUSTOMER}" \ --data-urlencode "sign=${SIGN}" \ --data-urlencode "param=${PARAM}") ``` 5. Add maximum argument lengths to prevent oversized signed requests. 6. Add tests covering quotes, backslashes, ampersands, equals signs, control characters, and excessively long input. 7. Preserve the existing shell quoting; input validation and structured encoding should supplement it rather than replace it. ]]>