T09 · Insecure Skill Coding Practices
Error
- Location
scripts/estimate.mjs:15- Finding
Shell Command Injection Through Auction ID and Proxy Configuration
- Content
View full analysis
/dev/null`, { encoding: 'utf8', timeout: 30000 } ); } catch (e) { return ''; } } ``` The URL passed to this function contains a command-line argument: ```js async function getProductInfo(id) { const url = `https://auctions.yahoo.co.jp/jp/auction/${id}`; const html = curl(url); ``` The product IDs originate directly from process arguments: ```js async function main() { const ids = process.argv.slice(2); ``` ### Technical Analysis The application builds a shell command by interpolating two untrusted values into a template string passed to `execSync()`: 1. `PROXY` is populated from the `PROXY_SOCKS5` environment variable and is inserted into the command without shell quoting. 2. `id` originates from a command-line argument and is incorporated into `url`. Although the URL is enclosed in double quotes, shell command substitution and certain other shell expansions remain active inside double-quoted strings. Because `execSync()` executes the resulting string through a shell, shell metacharacters in either value can change the intended command structure. The application does not validate auction IDs or parse and constrain the proxy URL before command construction. The 30-second timeout limits execution duration but does not prevent an injected command from running or spawning an independent process. ### Attack Path 1. An attacker obtains the ability to influence an auction ID supplied to the Skill, or the `PROXY_SOCKS5` environment variable. 2. The attacker supplies a value containing shell syntax, such as command ...[truncated 1118 chars]- Remediation
View remediation