T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/msg-sapconet.sh:9
- Finding
- Remote Command Injection Through Unsanitized Message Input<![CDATA[ ## Vulnerability Details **File Location**: `scripts/msg-sapconet.sh`, lines 9–14 **Vulnerability Type**: OS command injection through a remotely interpreted SSH command **Risk Level**: High ### Vulnerable Code ```bash REMOTE_TARGET="${REMOTE_TARGET:-neill@<YOUR_REMOTE_HOST>}" MESSAGE="$1" # Placeholder: replace with actual REMOTE inbox command # Keep NO_REPLY discipline for automated messages. ssh "${REMOTE_TARGET}" "echo 'TODO: send inbox message: ${MESSAGE}'" ``` ### Technical Analysis The first command-line argument is assigned to `MESSAGE` and interpolated directly into a command sent through SSH. Although the local shell treats the resulting text as one argument, SSH passes that command text to the remote login shell for interpretation. The message is enclosed in single quotes within the constructed remote command, but the value itself is not escaped. An attacker can include a single quote to terminate the intended string and then append arbitrary shell syntax. For example, a message resembling the following would break out of the `echo` argument: ```text '; id; # ``` This produces remote command text equivalent to: ```bash echo 'TODO: send inbox message: '; id; #' ``` The remote shell therefore executes `id` independently. Other commands could be substituted based on the attacker’s objectives and the privileges available to the configured SSH account. ### Attack Path 1. The attacker gains the ability to control the message passed as the first argument to `scripts/msg-sapconet.sh`, directly or through an automated workflow invoking the script. 2. The attacker supplies a message containing a closing single quote followed by shell syntax, such as `'; id; #`. 3. The script interpolates the value into the SSH command without validation or remote-shell-safe encoding. 4. SSH sends the constructed command to `REMOTE_TARGET`. 5. The remote login shell parses the injected metacharacters and executes the appended command. 6. The injected pro ...[truncated 657 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Do not concatenate message content into a command interpreted by a remote shell. 1. Send the message through standard input to a fixed remote executable whose command name and arguments are not attacker-controlled. 2. Ensure the receiving program reads the message as data rather than evaluating it as shell syntax. 3. Where possible, invoke a purpose-built remote messaging utility with a structured input format and strict validation. 4. If shell argument transport is unavoidable, apply a proven shell-quoting routine to every untrusted argument rather than relying on manually added quote characters. 5. Restrict the SSH account using least privilege, narrowly scoped authorization, and an SSH forced command if the workflow supports it. 6. Add regression tests covering single quotes, semicolons, newlines, backticks, command substitutions, redirections, and shell control operators. 7. Reject unexpected additional arguments and enforce reasonable message size and character-policy constraints as defense in depth. A safer design is conceptually: ```bash printf '%s\n' "$MESSAGE" | ssh -- "${REMOTE_TARGET}" 'fixed-remote-message-handler' ``` The fixed remote handler must consume standard input strictly as message data and must not pass it to `eval`, `sh -c`, or another shell-interpreted command. ]]>