T09 · Insecure Skill Coding Practices
Error
- Location
scripts/00_probe_env.sh:16- Finding
Arbitrary Python Code Injection Through Untrusted HTTP Geolocation Data
- Content
View full analysis
/dev/null || \ curl -s --max-time 5 http://ip-api.com/json 2>/dev/null | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('query',''))" 2>/dev/null) # Public IP attribution IP_INFO=$(curl -s --max-time 5 "http://ip-api.com/json/${MY_IP}" 2>/dev/null) ``` ```bash COUNTRY=$(echo "$IP_INFO" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('country','unknown'))" 2>/dev/null) CITY=$(echo "$IP_INFO" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('city','unknown'))" 2>/dev/null) ISP=$(echo "$IP_INFO" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('isp','unknown'))" 2>/dev/null) AS=$(echo "$IP_INFO" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('as','unknown'))" 2>/dev/null) python3 -c " import json data = { 'my_ip': '$MY_IP', 'country': '$COUNTRY', 'city': '$CITY', 'isp': '$ISP', 'as': '$AS', 'default_dns': '$DEFAULT_DNS'.strip(','), 'tools': { 'dig': '$DIG_OK' == 'true', 'traceroute': '$TRACEROUTE_OK' == 'true', 'ping': '$PING_OK' == 'true', 'whois': '$WHOIS_OK' == 'true' } } print(json.dumps(data, ensure_ascii=False, indent=2)) " | tee "$ENV_FILE" ``` ### Technical Analysis The script retrieves IP attribution data from `ip-api.com` over unencrypted HTTP. Values such as country, city, ISP, and autonomous-system information are then inserted directly into a string passed to `python3 -c`. Shell quoting does not make these values safe inside the generated Python program. An attacker able to alter the HTTP response can include quotes, commas, and Python expressions in a JSON string. After extraction, that string becomes executable ...[truncated 1746 chars]- Remediation
View remediation