T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:143- Finding
Arbitrary Command Execution Through GNU sed Script Injection
- Content
View full analysis
/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi echo "Set: $key=$val" ``` ### Technical Analysis The user-controlled `key` and `val` arguments are inserted directly into a `sed` program. Shell double-quoting prevents ordinary shell expansion of those values, but it does not make them safe as `sed` program text. An attacker can include the `|` delimiter, regular-expression metacharacters, literal newlines, and additional `sed` commands. On GNU `sed`, the `e` command executes a shell command. A crafted multiline value can therefore terminate the intended substitution and introduce an `e` instruction. The `grep` expressions are also built from an unescaped key: ```bash grep -q "^${key}=" "$cfg" ``` This permits regular-expression manipulation, although the command-execution sink is the subsequent dynamically generated `sed` program. ### Attack Path A representative exploitation sequence on a system using GNU `sed` is: 1. Create an entry so that the configuration update branch will be taken: ```bash scripts/script.sh config target initial ``` 2. Supply a value containing a substitution delimiter, a newline, and a GNU `sed` execution command: ```bash scripts/script.sh config target $'x|\ne touch /tmp/poka-yoke-pwned\n#' ``` 3. The interpolated `sed` program becomes equivalent to: ```sed s|^target=.*|target=x| e touch /tmp/poka-yoke-pwned #| ``` 4. GNU `sed` processes the injected `e` instruction and invokes the supplied shell command. 5. The command runs with the operating-system privileges of the user or service account that invoked the Skill. An attacker could replace the illustra ...[truncated 799 chars]- Remediation
View remediation
&2; return 1; } ``` - Reject control characters and newlines in values unless multiline values are explicitly required. - Replace the dynamic `sed` expression with a parser that treats keys and values strictly as data. For example, use a fixed `awk` program with values passed through `-v`, while ensuring newlines are prohibited or safely encoded. - Write the updated configuration to a securely created temporary file in the same directory, set restrictive permissions, and atomically rename it over the original file. - Avoid interpreting configuration keys as regular expressions. Use fixed-string comparison or parse each line at the first `=` delimiter. - Add regression tests containing `|`, backslashes, newlines, regular-expression metacharacters, and attempted `sed` commands. ]]>