T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fix_ssh_access.py:38- Finding
Remote Command Injection Through Unsafely Interpolated SSH Parameters
- Content
View full analysis
Vulnerability Details
File Location:
scripts/fix_ssh_access.py:38-80
Vulnerability Type: Shell command injection
Risk Level: HighThe
build_scriptfunction inserts the user-controlled--userand--portarguments and the contents of the--pubkeyfile directly into a Bash script. The resulting script is submitted to Alibaba Cloud SWAS Cloud Assistant for privileged execution on the selected instance.python def build_script(pub_key: str, user: str, port: str | None) -> str: port_block = "" if port: port_block = f""" if ! grep -q '^Port' $SSHD_CONFIG; then echo 'Port {port}' >> $SSHD_CONFIG else sed -i 's/^Port.*/Port {port}/' $SSHD_CONFIG fi """ return f"""#!/bin/bash set -e USER_NAME="{user}" HOME_DIR=$(getent passwd "$USER_NAME" | cut -d: -f6) if [ -z "$HOME_DIR" ]; then echo "User $USER_NAME not found" exit 1 fi mkdir -p "$HOME_DIR/.ssh" chmod 700 "$HOME_DIR/.ssh" if ! grep -qF '{pub_key}' "$HOME_DIR/.ssh/authorized_keys" 2>/dev/null; then echo '{pub_key}' >> "$HOME_DIR/.ssh/authorized_keys" fi chmod 600 "$HOME_DIR/.ssh/authorized_keys" chown -R "$USER_NAME":"$USER_NAME" "$HOME_DIR/.ssh" SSHD_CONFIG=/etc/ssh/sshd_config if ! grep -q '^PermitRootLogin' $SSHD_CONFIG; then echo 'PermitRootLogin yes' >> $SSHD_CONFIG else sed -i 's/^PermitRootLogin.*/PermitRootLogin yes/' $SSHD_CONFIG fi if ! grep -q '^PubkeyAuthentication' $SSHD_CONFIG; then echo 'PubkeyAuthentication yes' >> $SSHD_CONFIG else sed -i 's/^PubkeyAuthentication.*/PubkeyAuthentication yes/' $SSHD_CONFIG fi {port_block}Technical Analysis
Python f-string interpolation does not provide shell escaping. Each input is inserted into a different shell quoting context:
useris placed inside double quotes and can escape that context with an embedded double quote.portis placed inside single-quotedechoandsedarguments and c ...[truncated 1655 chars]
- Remediation
View remediation
Remediation Suggestions
- Validate
--useragainst a restrictive Linux username expression and additionally confirm that the account exists. - Parse
--portas an integer throughargparse, require a value from 1 through 65535, and render only the normalized integer. - Parse and validate the public key with a suitable SSH-key library. Permit only recognized public-key algorithms and reject embedded line breaks, shell metacharacters, malformed base64, and trailing data that is not an approved comment.
- Do not construct executable shell source from raw values. Transfer data through safely encoded input, such as base64-decoded data passed as positional arguments or files, and apply robust shell quoting when unavoidable.
- Avoid placing user input inside
sedprograms. Use a configuration-management library or a fixed script whose arguments are passed separately from its source. - Add tests covering quotes, command substitutions, line breaks, shell separators, option-like values, malformed keys, and out-of-range ports.
- Require explicit confirmation before sending a privileged remote command and log the target region and instance without logging sensitive key material.
- Validate