T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:143- Finding
Arbitrary Command Execution Through sed Program Injection
- Content
View full analysis
/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" ``` ### Technical Analysis The user-controlled `key` and `val` arguments are interpolated directly into a dynamically constructed sed program. Neither value is escaped for use as a regular expression, replacement string, or sed command. Although the shell quotes prevent ordinary shell metacharacters in the arguments from being interpreted directly by Bash, they do not prevent sed-language injection. An attacker can include the `|` delimiter and newline characters in a value to terminate the intended substitution and append additional sed commands. On GNU sed, the `e` command executes a supplied command through the system shell. Consequently, a malicious multiline value can transform the generated sed expression into multiple commands, including an attacker-controlled `e` command. The vulnerable branch is reached only when the selected key already exists in `config.txt`, but an attacker able to invoke the Skill can create the key in one request and update it with a malicious value in a subsequent request. ### Attack Path 1. The attacker invokes `scripts/script.sh config safe initial` to create an existing configuration key. 2. The attacker invokes the same command again with `safe` as the key and a crafted multiline value. 3. The value closes the intended `s|...|...|` expression and introduces a new GNU sed `e` instruction. 4. `cmd_config` embeds the value into the sed program without escaping. 5. GNU sed processes the injected `e` instruction and invokes the associated command through a shell. 6. The injected command runs with the operating-system privileges and environment of the user executing the Skill. ### Impact Assessme ...[truncated 547 chars]- Remediation
View remediation
&2 return 1 } ``` 2. Replace the dynamic sed expression with a configuration update routine that treats keys and values exclusively as data. A small dedicated parser or a safe structured format such as JSON is preferable. 3. If `awk` is used, pass values through `-v` rather than embedding them in program source, compare keys literally, and write the result to a securely created temporary file. 4. Atomically replace `config.txt` only after the rewritten file has been generated successfully. 5. Define and enforce a policy for control characters. Reject newlines and NUL bytes if configuration values are intended to remain one record per line. 6. Add regression tests using values containing sed delimiters, backslashes, ampersands, newlines, regular-expression characters, and strings resembling sed commands. ]]>