T09 · Insecure Skill Coding Practices
Error
- Location
metrics.ts:64- Finding
Shell Command Injection Through Unvalidated Environment Variables
- Content
View full analysis
(subcommand: string, limit: number, since?: string, cwd?: string): T[] { const sinceFlag = since ? ` --since=${since}` : '' try { const raw = execSync(`${BRV} ${subcommand} --format=json --limit=${limit}${sinceFlag}`, { encoding: 'utf8', ``` ### Technical Analysis The script reads `BRV_CMD` and `BRV_SINCE` from environment variables and interpolates them directly into a command string passed to `execSync`. String-form `execSync` executes the command through a system shell. Consequently, shell metacharacters contained in either environment variable are interpreted as command syntax rather than treated as literal argument content. No allowlist validation, shell escaping, or argument-array separation is applied. For example, a value such as `BRV_SINCE='24h; id'` causes the appended command to be executed after the intended `brv` invocation. `BRV_CMD` is likewise vulnerable and controls the beginning of both commands executed by the script. Although the values may normally be set by a trusted operator, environment variables are often inherited from CI jobs, cron environments, process supervisors, wrappers, or other automation. If an attacker can influence either variable, this flaw converts configuration control into arbitrary command execution. ### Attack Path 1. An attacker gains the ability to influence `BRV_CMD` or `BRV_SINCE` in the script's environment, such as through a CI variable, cron configuration, wrapper script, or deployment setting. 2. The attacker supplies shell syntax in the value, for example: ```sh BRV_SINCE='24h; id' ``` 3. The script constructs a command resembling: ```sh brv query-log view --format=json --limit=100 ...[truncated 976 chars]- Remediation
View remediation