T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:316- Finding
Arbitrary Command Execution Through Bash Arithmetic Injection
- Content
View full analysis
}" local monthly="${2:?Missing monthly amount}" ticker=$(echo "$ticker" | tr 'a-z' 'A-Z') echo -e "${BOLD}DCA Calculator: $ticker @ \$$monthly/month${RESET}" echo "" echo " Month Investment Cumulative" echo " ──────────────────────────────────" local total=0 for m in $(seq 1 12); do total=$((total + monthly)) printf " %-7d \$%-12s \$%s\n" "$m" "$monthly" "$total" done echo "" echo " Total invested after 12 months: \$$total" } ``` ### Technical Analysis The `monthly` parameter comes directly from a command-line argument and is not validated before being referenced in Bash arithmetic expansion: ```bash total=$((total + monthly)) ``` Bash recursively interprets the value of a variable used in an arithmetic expression as another arithmetic expression. Arithmetic syntax can include array references whose subscripts undergo shell expansion. Consequently, a malicious value containing an array-subscript expression with command substitution can cause Bash to execute a command while evaluating `monthly`. Merely quoting the argument when invoking the script does not make the arithmetic evaluation safe. The dangerous interpretation happens later, at line 327, inside Bash's arithmetic evaluator. ### Attack Path 1. An attacker supplies or persuades a user or agent to supply a crafted value as the second argument to `dca`. 2. The value is stored unchanged in the `monthly` shell variable. 3. The loop reaches `total=$((total + monthly))`. 4. Bash recursively parses the value of `monthly` as an arithmetic expression. 5. A command substitution embedded in an arithmetic array subscript is evaluated by the shell. 6. The injected comman ...[truncated 876 chars]- Remediation
View remediation