T09 · Insecure Skill Coding Practices
Error
- Location
- references/observe_application.md:24
- Finding
- Remote Command Injection Through Unvalidated Deployment State Fields<![CDATA[ ## Vulnerability Details **File Location**: `references/observe_application.md:24-31` **Related Location**: `references/workflow.md:14-25` **Vulnerability Type**: Shell command injection into Alibaba Cloud ECS Cloud Assistant **Risk Level**: High ### Vulnerable Code ```bash aliyun ecs RunCommand --RegionId <region> --Type RunShellScript --InstanceId.1 <ecs-id> \ --ContentEncoding Base64 \ --CommandContent "$(printf '%s' 'systemctl is-active <service_name>; systemctl is-active nginx; ss -ltnp | grep -E ":80|:<app_port>" || true' | base64)" ``` The values used in this command are obtained from the project-controlled deployment state: ```text 2. Parse the JSON state file. Extract: - `region_id`, `stack_id`, `topology`, `app_type`, `nginx_mode`, `app_port` - `service_name` (service name, used for service/log checks; falls back to `qwencloud-app` when missing) - `outputs.public_ip`, `outputs.ecs_instance_ids[]`, `outputs.security_group_id`, `outputs.eip_allocation_id` ... 4. Validate region and resource IDs are non-empty. Missing critical IDs → mark the affected layer `unknown` with the reason. ``` The same untrusted service name is also inserted into log commands: ```bash journalctl -u <service_name> --since '1 hour ago' --no-pager | tail -n 200 tail -n 200 /var/log/nginx/error.log ``` ### Technical Analysis The instructions require values such as `service_name` and `app_port` to be read from `.qwencloud-deploy` and substituted directly into shell source code. The documented validation only checks whether region and resource identifiers are non-empty. It does not require `service_name` to follow systemd unit-name syntax or `app_port` to be a numeric TCP port. An attacker-controlled value containing shell metacharacters, command substitutions, quotes, semicolons, or newlines could terminate the intended argument and add arbitrary shell commands. Encoding the resulting script with Base64 only prepares it for transport throug ...[truncated 1509 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse `.qwencloud-deploy` against a strict schema before making any cloud call. 2. Require `app_port` to be an integer in the range `1`–`65535`; reject strings and malformed values. 3. Allow only valid systemd unit identifiers for `service_name`, using a conservative allowlist such as letters, digits, `_`, `-`, `.`, and `@`, with an explicit maximum length. 4. Validate region identifiers, ECS instance IDs, security-group IDs, EIP IDs, and RDS IDs against their documented formats. 5. Do not generate shell source by direct string substitution. 6. Use a fixed diagnostic script and transmit dynamic values as safely quoted positional arguments. 7. Apply a proven shell-escaping implementation to every argument if shell execution cannot be avoided. 8. Reject state files containing unexpected fields, control characters, newlines, or shell metacharacters in command-related values. 9. Restrict `ecs:RunCommand` to only the deployment's ECS resources and require an explicit confirmation before invoking remote commands. ]]>