T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:135- Finding
Arbitrary Command Execution Through GNU sed Script Injection
- Content
View full analysis
)"; fi elif [ -z "$val" ]; then grep "^${key}=" "$cfg" 2>/dev/null | cut -d= -f2- || echo "(not set)" else if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi echo "Set: $key=$val" fi } ``` ### Technical Analysis The configuration key and value are inserted directly into a GNU `sed` program: ```bash sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" ``` Shell quoting prevents ordinary shell metacharacters in these variables from being interpreted directly by Bash, but it does not make the resulting sed program safe. An attacker can include the `|` delimiter, newline characters, regular-expression syntax, replacement metacharacters, or additional sed instructions in either argument. On GNU sed, the `e` command executes a system command. A newline-containing value can terminate the intended substitution and introduce an `e` instruction. This produces arbitrary command execution under the account running the Skill. The key is also interpolated into `grep` regular expressions on lines 143 and 146 without escaping. This permits unintended key matching and helps an attacker reach the vulnerable update branch. ### Attack Path A concrete exploitation sequence on a system using GNU sed is: 1. Create a normal configuration entry so that the update branch is reachable: ```bash ...[truncated 1396 chars]- Remediation
View remediation
&2 return 1 } ``` 3. Reject control characters, including carriage returns and newlines, in configuration values unless multiline values are explicitly supported with a safe storage format. 4. Replace the sed update operation with a parser that treats values as data rather than executable syntax. JSON handled through `jq --arg`, for example, avoids dynamic sed programs. 5. If the text format must be retained, rewrite it through a securely created temporary file, compare keys as literal strings, and atomically replace the original file. 6. Apply restrictive permissions to the data directory and configuration file, such as directory mode `0700` and file mode `0600`. 7. Add regression tests covering sed delimiters, backslashes, ampersands, newlines, regular-expression characters, and attempted `e`-command injection. ]]>