T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:140- Finding
Arbitrary Command Execution Through GNU sed Program Injection
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh, lines 140-145
Vulnerability Type: Shell command execution through sed-program injection
Risk Level: Highbash if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi echo "Set: $key=$val"Technical Analysis
The
configcommand inserts the user-controlledkeyandvalarguments directly into a dynamically constructed GNU sed program. The script does not validate or escape sed delimiters, regular-expression metacharacters, replacement metacharacters, or newline characters.An attacker can terminate the intended substitution with a
|character and inject a newline followed by GNU sed'secommand. Theecommand executes an operating-system command. A trailing comment can neutralize the delimiter appended by the script.This flaw is reachable when the selected configuration key already exists because that causes execution to enter the vulnerable
sed -ibranch.Attack Path
-
Create a valid configuration entry so the vulnerable update branch will be used:
bash scripts/script.sh config safe initial -
Supply a value containing a completed substitution, a newline, and a GNU sed
ecommand:bash scripts/script.sh config safe $'updated|\ne touch /tmp/actuator-pwned\n#' -
The script constructs a sed program equivalent to:
sed s|^safe=.*|safe=updated| e touch /tmp/actuator-pwned #| -
GNU sed executes
touch /tmp/actuator-pwnedwith the privileges of the user running the Skill. An attacker can replace this proof-of-concept command with other shell commands available in that security context.
Impact Assessment
Successful exploitation provides arbitrary local command execution with the privileges of the Skill process. In a n ...[truncated 507 chars]
-
- Remediation
View remediation
Remediation Suggestions
- Do not construct sed programs using untrusted input. Replace the dynamic
sed -ioperation with a safe line-by-line configuration rewrite in which the matching and output operations do not interpret input as executable syntax. - Validate configuration keys against a strict allowlist, such as
^[A-Za-z0-9_.-]+$. - Reject newline, carriage-return, NUL, and other control characters in both keys and values.
- If sed must be retained, escape regular-expression syntax in the key and all delimiter, backslash, ampersand, and newline-sensitive syntax in the replacement value. A parser-based rewrite is preferable because escaping sed safely is error-prone.
- Write updates to a securely created temporary file in the same directory, verify that the operation succeeded, apply restrictive permissions, and atomically rename the file over
config.txt. - Add regression tests using values containing
|,\,&, newlines, sed commands, and shell command text. Tests should verify that no command is executed and that the value is stored only as literal data.
- Do not construct sed programs using untrusted input. Replace the dynamic