T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:139- Finding
Arbitrary Command Execution Through Configuration Value Injection
- Content
View full analysis
/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi ``` ### Technical Analysis The `key` and `val` arguments are inserted directly into a GNU `sed` program. Shell quoting prevents immediate expansion by the invoking shell, but it does not prevent the arguments from being interpreted as `sed` syntax. An attacker can place the `|` delimiter, the GNU `sed` `e` execution flag, a newline, and a comment into `val`. This closes the replacement expression and instructs GNU `sed` to execute the resulting replacement as a shell command. A newline followed by `#` can consume the delimiter appended by the script and keep the injected `sed` program syntactically valid. The issue is reachable whenever the attacker can invoke the Skill with controlled configuration arguments and update an existing configuration key. ### Attack Path 1. Create an ordinary configuration entry so that the vulnerable update branch is reached: ```bash scripts/script.sh config test initial ``` 2. Invoke the command again with a crafted value containing shell syntax, a `sed` delimiter, the GNU `sed` execution flag, and a newline. Conceptually, the payload has this form: ```text ; attacker-command |e # ``` 3. The script constructs a `sed` expression equivalent to: ```sed s|^test=.*|test=; attacker-command |e #| ``` 4. On GNU `sed`, the `e` flag passes the generated replacement text to a shell. 5. The attacker-supplied command runs with the same operating-system privileges and environment as the Skill process. Successful exploitation depends on GNU `sed` behavior, which is consistent with the script's existing use of GNU-style `sed -i`. ...[truncated 607 chars]- Remediation
View remediation
&2 return 1 } ``` - Rewrite the configuration through a temporary file using a method that treats values strictly as data rather than executable syntax. - Prefer a structured format and serializer, such as JSON generated with `jq`. - If `awk` is used, pass values through variables and avoid constructing source code from them. - Create temporary files securely with `mktemp`, apply restrictive permissions, and atomically replace the original configuration. - Add tests containing delimiters, newlines, backslashes, semicolons, and other metacharacters to verify that configuration values cannot alter program syntax. ]]>