T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:140- Finding
Arbitrary Command Execution Through GNU sed Program Injection
- Content
View full analysis
)"; fi elif [ -z "$val" ]; then grep "^${key}=" "$cfg" 2>/dev/null | cut -d= -f2- || echo "(not set)" else if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi echo "Set: $key=$val" fi } ``` ### Technical Analysis The `key` and `val` arguments are inserted directly into regular expressions and a dynamically constructed `sed` substitution program. Shell double quoting prevents ordinary shell word splitting, but it does not escape characters that have special meaning to `sed`, including the `|` delimiter, newlines, regular-expression syntax, and command flags. On GNU `sed`, the `e` substitution flag executes the resulting replacement text as a shell command. A malicious value can terminate the replacement expression, append the `e` flag, and use an embedded newline and comment to neutralize the remainder of the generated program. This converts a configuration update into arbitrary command execution. The vulnerable branch is reached when the selected configuration key already exists. ### Attack Path 1. The attacker or an attacker-controlled automation process invokes the Skill with configuration arguments. 2. An initial call creates a known key: ```bash scripts/script.sh config foo safe ``` 3. A subsequent call supplies a crafted multiline value containing th ...[truncated 1244 chars]- Remediation
View remediation
&2 return 1 fi ``` 2. Reject newlines, carriage returns, NUL bytes, and other control characters in configuration values. 3. Replace the dynamic `sed` command with a safe configuration writer that treats keys and values exclusively as data. 4. Write the updated configuration to a securely created temporary file in the same directory and atomically rename it over the original file. 5. Set restrictive directory and file permissions, such as `0700` for the data directory and `0600` for configuration files. 6. Add regression tests using values containing `|`, backslashes, ampersands, newlines, regular-expression metacharacters, and strings resembling `sed` flags. 7. Avoid printing sensitive configuration values in the confirmation message. ]]>