T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:133- Finding
Arbitrary Command Execution Through Sed Program Injection
- Content
View full analysis
)"; fi elif [ -z "$val" ]; then grep "^${key}=" "$cfg" 2>/dev/null | cut -d= -f2- || echo "(not set)" else if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi echo "Set: $key=$val" fi } ``` ### Technical Analysis The configuration key and value are inserted directly into a sed program: ```bash sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" ``` Shell quoting prevents an additional shell expansion pass, but it does not make the resulting text safe as sed syntax. An attacker can include the `|` delimiter, newline characters, backreferences, or additional sed commands in `key` or `val`. On GNU sed, an injected `e` command can execute an arbitrary shell command. This path is reached when the configuration file already contains a line matching the supplied key. The key is also interpreted as a regular expression by `grep` and sed rather than as a literal configuration key. ### Attack Path 1. Ensure that an existing configuration key is present: ```bash scripts/script.sh config theme default ``` 2. Construct a value that closes the substitution and introduces a GNU sed `e` command: ```bash payload=$'safe|\ne touch /tmp/cobot-command-executed\n#' ``` 3. Update the existing key: ```bash scripts/script.sh config theme "$payload" ``` 4. The expa ...[truncated 824 chars]- Remediation
View remediation
&2 return 1 } ``` - Reject control characters, including carriage returns and newlines, if the line-oriented configuration format is retained. - Replace the sed update with a routine in which input is passed as data rather than executable syntax. A structured configuration format and serializer are preferred. - Write updates to a securely created temporary file in the same directory, validate successful serialization, set restrictive permissions, and atomically rename it over the original file. - Add regression tests covering delimiter characters, newlines, regular-expression metacharacters, backslashes, and attempted sed command injection. ]]>