T09 · Insecure Skill Coding Practices
Error
- Location
scripts/network_monitor.sh:3- Finding
Unvalidated Environment Parameters Reach Privileged Network Routing Commands
- Content
View full analysis
> "$LOG_FILE"; } check_iface() { ping -c $CHECK_COUNT -I $1 $CHECK_TARGET > /dev/null 2>&1; } log "Network monitoring started, backup: $MAIN_IFACE -> $BACKUP_IFACE" while true; do if ! check_iface $MAIN_IFACE; then log "Primary network failed, switching to $BACKUP_IFACE" ip route replace default dev $BACKUP_IFACE 2>> "$LOG_FILE" ``` ### Technical Analysis `MAIN_IFACE`, `BACKUP_IFACE`, and `CHECK_TARGET` can be supplied through the process environment. Their values are used in `ping` and `ip` invocations without validation or quoting. Unquoted shell expansions undergo word splitting and pathname expansion. Consequently, one environment value can become multiple command-line arguments. Values beginning with option-like characters may also be interpreted as options rather than interface names or connectivity targets. This does not directly cause shell metacharacters embedded inside a variable to be parsed as new shell syntax. However, it does permit argument and option injection into security-sensitive system utilities. The risk is especially significant because `ip route replace default` requires elevated network-administration privileges, normally root or `CAP_NET_ADMIN`. The script also automatically changes the system default route whenever the connectivity test fails. It does not verify that the backup interface exists, is operational, belongs to an approved interface set, or provides the intended gateway. ### Attack Path 1. An attacker or less-privileged deployment component obtains control over the environment used to launch the monitor. 2. The attacker supplies mal ...[truncated 1189 chars]- Remediation
View remediation
/dev/null 2>&1 } ip route replace default dev "$BACKUP_IFACE" ``` 2. Validate interface names against interfaces that actually exist: ```bash validate_iface() { local iface="$1" [[ "$iface" =~ ^[A-Za-z0-9_.:-]+$ ]] && ip link show dev "$iface" >/dev/null 2>&1 } ``` 3. Reject values beginning with `-` and enforce an explicit allowlist when the expected interfaces are known. 4. Validate `CHECK_TARGET` as an approved IP address or hostname. Prefer a fixed configuration file owned by root over an untrusted process environment. 5. Verify that the backup interface is operational and has an approved gateway before changing the default route. 6. Run the monitor in a dedicated network namespace where possible. Otherwise, grant only the specific capability required, such as `CAP_NET_ADMIN`, rather than running it with unrestricted root privileges. 7. Add a rollback mechanism and rate limiting so a failed backup route does not leave the host disconnected or cause repeated route changes. ]]>