T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/track.sh:191- Finding
Unvalidated command-line input is interpolated into a signed API request
- Content
View full analysis
32位大写MD5 SIGN=$(calc_md5 "${PARAM}${API_KEY}${CUSTOMER}") # ---- 发起查询 ---- echo "📦 正在查询单号: ${TRACKING_NUM}" echo "" RESPONSE=$(curl -s -X POST "https://poll.kuaidi100.com/poll/query.do" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "customer=${CUSTOMER}&sign=${SIGN}¶m=${PARAM}") ``` ### Technical Analysis `CARRIER_CODE` and `TRACKING_NUM` originate from command-line arguments and are inserted directly into a JSON string without JSON encoding or strict validation. Shell quoting prevents these values from being evaluated directly as shell commands, but it does not make them safe for the JSON or form-encoded data layers. Characters such as double quotes, backslashes, control characters, equals signs, and ampersands can break or modify the intended request structure. In particular: - Quotes and backslashes can produce malformed JSON or introduce additional JSON members. - Ampersands can split the raw `curl -d` body into additional form fields because the completed `param` value is not independently URL-encoded. - The resulting attacker-controlled request is signed using the legitimate API key and customer identifier before being submitted to Kuaidi100. The exact interpretation of duplicate or injected fields depends on the remote API parser. Therefore, arbitrary server-side field manipulation is not guaranteed, but malformed requests and signed request tampering are demonstrably possible. ### Attack Path 1. An attacker supplies a crafted tracking number or manually supplied carrier code through a package-tracking request. 2. The agent invokes `scripts/track.sh` with the ...[truncated 1223 chars]- Remediation
View remediation