T09 · Insecure Skill Coding Practices
Error
- Location
scripts/msg-sapconet.sh:9- Finding
Remote Command Injection Through Unsanitized Message Input
- Content
View full analysis
}" MESSAGE="$1" # Placeholder: replace with actual REMOTE inbox command # Keep NO_REPLY discipline for automated messages. ssh "${REMOTE_TARGET}" "echo 'TODO: send inbox message: ${MESSAGE}'" ``` ### Technical Analysis The first command-line argument is assigned to `MESSAGE` and interpolated directly into a command sent through SSH. Although the local shell treats the resulting text as one argument, SSH passes that command text to the remote login shell for interpretation. The message is enclosed in single quotes within the constructed remote command, but the value itself is not escaped. An attacker can include a single quote to terminate the intended string and then append arbitrary shell syntax. For example, a message resembling the following would break out of the `echo` argument: ```text '; id; # ``` This produces remote command text equivalent to: ```bash echo 'TODO: send inbox message: '; id; #' ``` The remote shell therefore executes `id` independently. Other commands could be substituted based on the attacker’s objectives and the privileges available to the configured SSH account. ### Attack Path 1. The attacker gains the ability to control the message passed as the first argument to `scripts/msg-sapconet.sh`, directly or through an automated workflow invoking the script. 2. The attacker supplies a message containing a closing single quote followed by shell syntax, such as `'; id; #`. 3. The script interpolates the value into the SSH command without validation or remote-shell-safe encoding. 4. SSH sends the constructed command to `REMOTE_TARGET`. 5. The remote login shell parses the injected metacharacters and executes the appended command. 6. The injected pro ...[truncated 657 chars]- Remediation
View remediation