T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/msg-sapconet.sh:9
- Finding
- Remote Command Injection Through Unescaped Message Input## Vulnerability Details **File Location**: `scripts/msg-sapconet.sh`, lines 9–13 **Vulnerability Type**: Remote shell command injection **Risk Level**: High ### Vulnerable Code ```bash SAPCONET_TARGET="${SAPCONET_TARGET:-neill@100.110.24.44}" MESSAGE="$1" # Placeholder: replace with actual SAPCONET inbox command # Keep NO_REPLY discipline for automated messages. ssh "${SAPCONET_TARGET}" "echo 'TODO: send inbox message: ${MESSAGE}'" ``` ### Technical Analysis The script places the first command-line argument into `MESSAGE` and directly interpolates it into a double-quoted SSH command. Although the remote `echo` argument is surrounded by single quotes, the message itself is not escaped. The SSH client sends the resulting command string to a shell on the remote SAPCONET host. An attacker-controlled single quote can terminate the intended quoted argument, after which shell metacharacters can introduce additional commands. Local quoting does not protect the value once it has been incorporated into remote shell source. For example, a message shaped like the following can break out of the intended `echo` operation: ```text '; id; echo ' ``` This vulnerability exists even though the current operation is described as a placeholder. Invoking the script with untrusted message content is sufficient to reach the vulnerable command. ### Attack Path 1. An attacker obtains influence over the message passed as the script's first argument. 2. The attacker includes a single quote, command separator, and arbitrary shell command in that message. 3. The script stores the payload unchanged in `MESSAGE`. 4. Line 13 interpolates the payload into the SSH command string. 5. SSH submits the constructed string to the remote login shell. 6. The remote shell interprets the injected syntax and executes the attacker's command in addition to the intended `echo`. A representative invocation is: ```bash bash scripts/msg-sapconet.sh "'; id; echo '" ``` Conceptually, this produces a ...[truncated 689 chars]
- Remediation
- ## Remediation Suggestions Do not construct remote shell source by interpolating untrusted message content. Use a fixed remote command and transfer the message through standard input or a safely defined data channel. For example, where the eventual inbox command accepts standard input: ```bash printf '%s' "$MESSAGE" | ssh -- "${SAPCONET_TARGET}" 'fixed-inbox-command --message-from-stdin' ``` Additional hardening measures should include: 1. Replace the placeholder with a fixed, reviewed remote executable rather than dynamically generated shell syntax. 2. Ensure the remote program treats the supplied message strictly as data. 3. If standard input cannot be used, encode the message locally, decode it in a fixed remote command, and avoid evaluating decoded content as shell code. 4. Avoid relying solely on character blacklists. If business requirements permit, enforce an explicit length limit and allowlist for acceptable message characters as defense in depth. 5. Restrict `SAPCONET_TARGET` to approved hosts and users where the execution environment permits attacker-controlled environment variables. 6. Configure the remote SSH key with least privilege, potentially using an authorized-keys forced command that exposes only the required inbox operation. 7. Add tests covering single quotes, semicolons, command substitutions, newlines, and shell metacharacters to verify they are handled only as message data.