T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fix_ssh_access.py:38- Finding
Privileged Remote Shell Injection Through Unsafely Interpolated SSH Parameters
- Content
View full analysis
str: port_block = "" if port: port_block = f""" if ! grep -q '^Port' $SSHD_CONFIG; then echo 'Port {port}' >> $SSHD_CONFIG else sed -i 's/^Port.*/Port {port}/' $SSHD_CONFIG fi """ return f"""#!/bin/bash set -e USER_NAME="{user}" HOME_DIR=$(getent passwd "$USER_NAME" | cut -d: -f6) if [ -z "$HOME_DIR" ]; then echo "User $USER_NAME not found" exit 1 fi mkdir -p "$HOME_DIR/.ssh" chmod 700 "$HOME_DIR/.ssh" if ! grep -qF '{pub_key}' "$HOME_DIR/.ssh/authorized_keys" 2>/dev/null; then echo '{pub_key}' >> "$HOME_DIR/.ssh/authorized_keys" fi chmod 600 "$HOME_DIR/.ssh/authorized_keys" chown -R "$USER_NAME":"$USER_NAME" "$HOME_DIR/.ssh" SSHD_CONFIG=/etc/ssh/sshd_config if ! grep -q '^PermitRootLogin' $SSHD_CONFIG; then echo 'PermitRootLogin yes' >> $SSHD_CONFIG else sed -i 's/^PermitRootLogin.*/PermitRootLogin yes/' $SSHD_CONFIG fi if ! grep -q '^PubkeyAuthentication' $SSHD_CONFIG; then echo 'PubkeyAuthentication yes' >> $SSHD_CONFIG else sed -i 's/^PubkeyAuthentication.*/PubkeyAuthentication yes/' $SSHD_CONFIG fi {port_block} ``` The untrusted values are obtained and executed as follows: ```python parser.add_argument("--user", default="root") parser.add_argument("--port", help="Set SSH port in sshd_config") parser.add_argument("--pubkey", default="~/.ssh/id_ed25519.pub") args = parser.parse_args() pubkey_path = os.path.expanduser(args.pubkey) with open(pubkey_path, "r", encoding="utf-8") as f: pub_key = f.read().strip() script = build_script(pub_key, args.user, args.port) client = create_client(args.region) resp = client.run_command(swas_models.RunCommandRequest( region_id=args.region, instance_id=args.instance_id, n ...[truncated 2402 chars]- Remediation
View remediation