T09 · Insecure Skill Coding Practices
Error
- Location
scripts/birdx.js:613- Finding
Shell Command Injection Through an Unvalidated Username
- Content
View full analysis
/dev/null`, { timeout: 15000 }).toString().trim(); const data = JSON.parse(out); ``` ### Technical Analysis The `username` value originates from a positional command-line argument. Removing an optional leading `@` does not validate or escape the value. The resulting `handle` is interpolated directly into a command string passed to `execSync()`. Because the string form of `execSync()` invokes a shell, shell metacharacters contained in the username can introduce additional commands, pipelines, substitutions, or redirections. The vulnerable path is reachable through both the `followers` and `following` commands. The external command also redirects standard error through shell syntax, confirming that the command is deliberately interpreted by a shell rather than executed as a fixed executable with an argument array. ### Attack Path 1. An attacker persuades a user, automation agent, or service to invoke `birdx followers` or `birdx following` with an attacker-controlled username. 2. CLI parsing accepts the positional value without validating it as an X username. 3. `cmdFollowers()` or `cmdFollowing()` passes the value to `resolveUsernameToId()`. 4. `resolveUsernameToId()` interpolates the value into the `bird user-tweets ...` shell command. 5. Shell metacharacters in the supplied value alter the command structure. 6. The injected command executes with the privileges and environment of the user running `birdx`. For example, a value structurally equivalent to `validname; additional-command` would cause the shell to interpret the text following the semicolon as another command. ### Impact Assessment Successful ...[truncated 629 chars]- Remediation
View remediation