T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:20
- Finding
- Unvalidated HOST Input Permits Command-Line Argument Injection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20-30; additional affected commands at lines 52, 69, 74, 80, and 103 **Vulnerability Type**: Command-line argument injection through unquoted and unvalidated input **Risk Level**: Medium ### Complete Vulnerable Code ```bash # Get certificate details echo | openssl s_client -connect $HOST:443 -servername $HOST 2>/dev/null | openssl x509 -noout \ -subject -issuer -dates -fingerprint -ext subjectAltName 2>&1 # Check full chain echo | openssl s_client -connect $HOST:443 -servername $HOST -showcerts 2>/dev/null | \ awk '/BEGIN CERT/,/END CERT/{print}' | \ openssl x509 -noout -subject -issuer -dates 2>&1 # Days until expiry echo | openssl s_client -connect $HOST:443 -servername $HOST 2>/dev/null | \ openssl x509 -noout -enddate 2>&1 | \ ``` Other affected commands include: ```bash result=$(echo | openssl s_client -connect $HOST:443 -$proto 2>&1) ``` ```bash nmap --script ssl-enum-ciphers -p 443 $HOST 2>/dev/null || \ openssl s_client -connect $HOST:443 -cipher 'ALL' 2>&1 | grep "Cipher is" ``` ```bash result=$(echo | openssl s_client -connect $HOST:443 -cipher "$cipher" 2>&1) ``` ```bash curl -sI "https://$HOST" | grep -iE "^(strict-transport|x-frame|x-content|content-security|referrer|permissions|x-xss)" 2>&1 ``` ```bash echo | openssl s_client -connect $HOST:443 2>/dev/null | openssl x509 -noout -text | \ ``` ### Technical Analysis The skill does not define a validation policy for `HOST`, and most OpenSSL and Nmap commands expand `$HOST` without quotation marks. In a POSIX-compatible shell, an unquoted variable undergoes word splitting and pathname expansion. Consequently, a value containing spaces or wildcard characters can become multiple command-line arguments. This does not directly reinterpret embedded shell separators such as semicolons as shell syntax, because shell metacharacters introduced by parameter expansion are not parsed again as control operators. However, ...[truncated 1925 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate `HOST` before using it: - Permit only a syntactically valid DNS hostname, IPv4 address, or IPv6 address. - Reject whitespace, control characters, shell wildcard characters, URL delimiters, and leading hyphens. - Keep the port in a separately validated numeric variable if custom ports are supported. 2. Quote every expansion: ```bash openssl s_client -connect "${HOST}:443" -servername "$HOST" ``` 3. Terminate Nmap option processing before the target: ```bash nmap --script ssl-enum-ciphers -p 443 -- "$HOST" ``` 4. Prefer arrays in Bash when constructing commands so each logical value remains exactly one argument. 5. Apply an explicit authorization policy, such as an approved-host allowlist, before initiating active network scans. 6. For curl, construct the URL only after hostname validation and consider restricting redirects and protocols: ```bash curl --proto '=https' --max-redirs 0 -sI "https://${HOST}/" ``` ]]>