T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:145- Finding
Arbitrary Command Execution Through Configuration Value Injection
- Content
View full analysis
/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi ``` ### Technical Analysis The `cmd_config` function interpolates the user-controlled `key` and `val` arguments directly into a `sed` program. Shell quoting prevents immediate shell expansion of characters contained inside these arguments, but it does not prevent those characters from altering the syntax interpreted later by `sed`. An attacker can place the `|` delimiter in `val` to terminate the replacement expression and append GNU `sed` flags. In particular, GNU `sed` supports the `e` substitution flag, which passes the resulting pattern space to a shell for execution. For example, the value: ```text $(touch /tmp/pwn)|e;# ``` causes the script to construct a `sed` expression equivalent to: ```sed s|^theme=.*|theme=$(touch /tmp/pwn)|e;#| ``` When the target line matches, the `e` flag executes the substituted content through a shell. The command substitution therefore runs `touch /tmp/pwn`. Other shell commands could be substituted to read, modify, or delete files available to the invoking account. The vulnerable update branch requires the configuration file to exist and contain a line matching the supplied key. An attacker can satisfy this precondition through an initial ordinary configuration command. ### Attack Path 1. Invoke the configuration command with a benign value to create the configuration file and target key: ```bash scripts/script.sh config theme safe ``` 2. Invoke the same command with a crafted value that terminates the `sed` replacement and enables GNU `sed` command execution: ```bash scripts/script.sh config theme '$(touch /tmp/pwn)|e;#' ``` 3. The existing `theme` en ...[truncated 1310 chars]- Remediation
View remediation
&2 return 1 fi ``` 2. Replace the `sed`-based update with a configuration-writing implementation that treats keys and values exclusively as data. Avoid dynamically constructing code for `sed`, `awk`, shells, or similar interpreters. 3. Write updates to a securely created temporary file in the same directory and atomically rename it over the original file. Ensure cleanup occurs on errors or signals. 4. Reject or safely encode line breaks in values because the storage format is line-oriented. Clearly define whether characters such as carriage returns, newlines, and NUL bytes are supported. 5. Create the data directory and configuration file with restrictive permissions, such as directory mode `0700` and file mode `0600`, where appropriate. 6. Add regression tests covering: - The `|` delimiter and other punctuation. - GNU `sed` flags such as `e`. - Command substitutions such as `$(...)` and backticks. - Semicolons, backslashes, ampersands, and newlines. - Regular-expression metacharacters in keys. - Values beginning with dashes or containing shell syntax. Escaping only the current `sed` delimiter is insufficient unless every character meaningful in the regular expression, replacement, command separator, and flags sections is handled correctly. A non-interpreted data-processing implementation is strongly preferred. ]]>