T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/script.sh:372
- Finding
- Option Injection Through User-Controlled grep Patterns<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh`, lines 372–422 **Vulnerability Type**: Argument/option injection **Risk Level**: Medium ### Vulnerable Code ```bash count=$(grep -c "$pattern" "$file" 2>/dev/null || echo 0) if [[ "$count" -gt 0 ]]; then grep -n --color=never -C 2 "$pattern" "$file" || true fi ``` ```bash matches=$(grep -oP "$regex" "$file" 2>/dev/null || grep -oE "$regex" "$file" 2>/dev/null || true) ``` ### Technical Analysis The `lines` and `extract` commands pass attacker-controlled `$pattern` and `$regex` values to `grep` without placing the `--` end-of-options delimiter before them. Quoting prevents shell expansion and shell-command injection, but it does not stop `grep` from interpreting an argument beginning with `-` as an option. An attacker can therefore supply values such as `--file=/path/to/file`, causing `grep` to treat the value as an option rather than as the intended regular expression. Depending on the injected option, this can cause `grep` to read patterns from another local file, change matching behavior, manipulate output, or consume excessive resources. This issue does not directly permit arbitrary shell-command execution because the variables are correctly quoted and are not passed to `eval` or a shell interpreter. ### Attack Path 1. An attacker gains control over the pattern or regular-expression argument supplied to the parser, for example: ```bash scripts/script.sh lines target.txt '--file=/etc/passwd' ``` or: ```bash scripts/script.sh extract target.txt '--file=/path/to/attacker-selected-file' ``` 2. The script forwards the argument to `grep` before any `--` delimiter. 3. GNU `grep` interprets the supplied value as a command-line option. 4. `grep` reads the selected file as a pattern source or otherwise changes its execution behavior. 5. The attacker may use resulting matches, errors, timing, or resource consumption to affect availability or infer limited inform ...[truncated 659 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Insert the `--` end-of-options delimiter before every user-controlled pattern: ```bash count=$(grep -c -- "$pattern" "$file" 2>/dev/null || echo 0) if [[ "$count" -gt 0 ]]; then grep -n --color=never -C 2 -- "$pattern" "$file" || true fi ``` For extraction: ```bash matches=$( grep -oP -- "$regex" "$file" 2>/dev/null || grep -oE -- "$regex" "$file" 2>/dev/null || true ) ``` Additional hardening measures should include: 1. Apply limits to input-file size and execution time to reduce regular-expression denial-of-service risk. 2. Validate patterns where only a restricted matching syntax is required. 3. Run the parser with least privilege so it cannot access unrelated sensitive files. 4. Add regression tests using patterns such as `-n`, `--help`, and `--file=/etc/passwd` to confirm that they are treated strictly as patterns. ]]>