T09 · Insecure Skill Coding Practices
- Location
archive_case.py:374- Finding
PowerShell Command Injection Through Unescaped Document Paths
- Content
View full analysis
Vulnerability Details
File Location:
archive_case.py, lines 374-386
Vulnerability Type: PowerShell command injection
Risk Level: Highpython def docx_to_pdf(docx_path, pdf_path): """Word转PDF（需要Windows + Word COM）""" import subprocess cmd = f''' $word = New-Object -ComObject Word.Application; $word.Visible = $false; $word.DisplayAlerts = 0; $doc = $word.Documents.Open("{docx_path}"); $doc.ExportAsFixedFormat("{pdf_path}", 17); $doc.Close($false); $word.Quit() ''' subprocess.run(['powershell', '-Command', cmd], capture_output=True)Technical Analysis
The
docx_pathandpdf_pathparameters are inserted directly into dynamically constructed PowerShell source code. They are not escaped, validated, or passed as non-code parameters.An attacker who can control either parameter can include PowerShell syntax that terminates the quoted string and introduces additional commands. Passing PowerShell as an argument list does not prevent this vulnerability because the entire interpolated value is supplied to the PowerShell interpreter through
-Command.The normal command-line workflow derives these paths from a case directory and case name, which limits exploitation on Windows because some metacharacters are prohibited in filenames. However,
docx_to_pdf()is a public Python function and can be called directly by another script or integration with arbitrary strings. Paths may also originate from less restrictive application-level inputs in future integrations.The function ignores the subprocess return code and prints a successful-conversion message even if PowerShell fails. This can conceal exploitation attempts and conversion errors.
Attack Path
- An attacker gains control over a value passed as
docx_pathorpdf_path, such as through a Python integration that callsdocx_to_pdf()directly. - The attacker supplies a cra ...[truncated 970 chars]
- An attacker gains control over a value passed as
- Remediation
View remediation
Remediation Suggestions
- Do not construct executable PowerShell source by interpolating paths.
- Prefer a conversion API that accepts paths as ordinary arguments, such as a controlled Python COM integration.
- If PowerShell is required, place the conversion logic in a fixed, reviewed
.ps1file and invoke it usingpowershell -File, passing document paths as separate parameters. - Resolve paths with
Path.resolve()and enforce that input and output paths remain inside an approved case directory. - Require expected extensions such as
.docxand.pdf, and reject control characters or values that do not represent valid filesystem paths. - Use PowerShell's literal-path handling where supported.
- Run conversion with the least-privileged account necessary.
- Set
check=True, inspect the return code and standard error, and report conversion success only after confirming that the expected PDF exists.