T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/monitor_dividend_premium.py:21
- Finding
- Shell Command Injection in Telegram Alert Delivery<![CDATA[ ## Vulnerability Details **File Location**: `scripts/monitor_dividend_premium.py`, lines 21–36 **Vulnerability Type**: OS command injection through unsafe shell command construction **Risk Level**: High ### Vulnerable Code ```python TELEGRAM_TOKEN = os.getenv("TELEGRAM_BOT_TOKEN", "") TELEGRAM_CHAT_ID = "505395883" def send_telegram(message): """发送Telegram消息""" if not TELEGRAM_TOKEN: print("未配置Telegram Bot Token") return False cmd = f"""curl -s -X POST https://api.telegram.org/bot{TELEGRAM_TOKEN}/sendMessage \ -d chat_id={TELEGRAM_CHAT_ID} \ -d text="{message}" \ -d parse_mode=HTML""" os.system(cmd) return True ``` ### Technical Analysis The function embeds `TELEGRAM_TOKEN` and `message` directly into a shell command and executes the result with `os.system()`. The shell interprets command separators, substitutions, redirections, and quoting characters contained in these values. The token is read from the process environment. Alert messages also include values derived from the writable CSV data set. Consequently, an attacker who can influence either source can introduce shell syntax that escapes the intended `curl` command. Using HTTPS does not mitigate this issue because command injection occurs locally before `curl` sends the request. Execution inherits the environment, filesystem access, and operating-system privileges of the account running the Skill. ### Attack Path 1. An attacker gains the ability to control `TELEGRAM_BOT_TOKEN` or modify a value in the CSV file read by the monitoring script. 2. The attacker inserts shell metacharacters or command-substitution syntax into the controlled value. 3. An alert condition is triggered, such as a premium below the configured threshold. 4. `send_telegram()` interpolates the malicious value into `cmd`. 5. `os.system(cmd)` launches a shell and interprets the injected syntax. 6. The injected command executes with the privileges of the us ...[truncated 705 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove `os.system()` and avoid constructing commands through string interpolation. - Prefer a Python HTTPS client such as `urllib.request` or `requests`. - If `curl` must be used, call `subprocess.run()` with a fixed argument list and `shell=False`, for example: ```python subprocess.run( [ "curl", "-sS", "-X", "POST", f"https://api.telegram.org/bot{TELEGRAM_TOKEN}/sendMessage", "--data-urlencode", f"chat_id={TELEGRAM_CHAT_ID}", "--data-urlencode", f"text={message}", "--data-urlencode", "parse_mode=HTML", ], check=True, timeout=30, ) ``` - Validate the Telegram token against the expected token format before use. - Treat all CSV fields as untrusted input and validate dates and numeric values before including them in messages. - Apply request timeouts and check response status rather than returning success unconditionally. - Do not configure unattended cron execution until the shell-injection path has been removed. ]]>