T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/script.sh:149
- Finding
- Bash Arithmetic Expansion Allows Command Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh:149-153` **Vulnerability Type**: Command injection through unsafe arithmetic evaluation **Risk Level**: High ### Vulnerable Code ```bash cmd_hex() { local file="${1:?}" local n="${2:-256}" xxd "$file" 2>/dev/null | head -$((n / 16 + 1)) || od -A x -t x1z "$file" | head -$((n / 16 + 1)) } ``` ### Technical Analysis The second argument to `hex` is copied directly into `n` and then evaluated inside Bash arithmetic expansion: ```bash $((n / 16 + 1)) ``` Bash can recursively interpret variable values as arithmetic expressions. Crafted expressions involving array subscripts and command substitutions can therefore cause shell commands to execute while Bash evaluates the ostensibly numeric value. Quoting the initial assignment does not make the later arithmetic evaluation safe. The value must be validated as a decimal integer before it is used in an arithmetic context. ### Attack Path 1. An attacker persuades a user or automated process to invoke `scripts/script.sh hex` with an attacker-controlled second argument. 2. The argument contains a malicious arithmetic expression that triggers command substitution during recursive arithmetic evaluation. 3. `cmd_hex` evaluates the argument in `$((n / 16 + 1))`. 4. The embedded command executes before `head` receives its numeric argument. 5. The command runs with the operating-system privileges of the user or service executing the skill. ### Impact Assessment Successful exploitation provides arbitrary command execution as the current skill process account. The attacker can read or modify files accessible to that account, invoke local programs, alter project data, and potentially access credentials available in the process environment or user account. This does not independently grant elevated system privileges, but its scope includes all resources already accessible to the invoking account. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions Validate the byte-count argument before performing arithmetic and pass the resulting value to `head` using its explicit option form: ```bash cmd_hex() { local file="${1:?Usage: file-converter hex <file> [n]}" local n="${2:-256}" local lines [[ "$n" =~ ^[0-9]+$ ]] || { printf 'Invalid byte count: %s\n' "$n" >&2 return 2 } (( n <= 1048576 )) || { printf 'Byte count exceeds the permitted limit\n' >&2 return 2 } lines=$((n / 16 + 1)) if command -v xxd >/dev/null 2>&1; then xxd "$file" 2>/dev/null | head -n "$lines" else od -A x -t x1z "$file" | head -n "$lines" fi } ``` Use a reasonable upper bound to prevent resource abuse. Do not evaluate arbitrary user strings as arithmetic expressions. ]]>