T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:365- Finding
Arbitrary Command Execution Through eval-Based COSCMD Configuration
- Content
View full analysis
/dev/null && \ ok "coscmd configured" || \ warn "coscmd installation/configuration failed" ``` ### Technical Analysis The script concatenates user-controlled setup values into a single command string and executes that string with `eval`. The affected values include the secret ID, secret key, bucket, region, and optional service domain. Shell metacharacters embedded in any of these values are treated as command syntax when `eval` reparses the string. Quoting the arguments when initially invoking `setup.sh` does not prevent exploitation because the quotes are removed during initial argument parsing, and the resulting value is later evaluated as shell source. For example, a malicious service-domain value containing a command separator can terminate the intended `coscmd` argument and append an arbitrary command. ### Attack Path 1. An attacker supplies or convinces a user to use a crafted setup value, such as a malicious `--service-domain`. 2. `do_setup` stores the value in `SERVICE_DOMAIN`. 3. The script concatenates it into `COSCMD_ARGS`. 4. `eval` reparses the resulting text as a shell command. 5. Shell metacharacters in the supplied value execute an attacker-selected command. 6. The command runs with the privileges of the user executing `setup.sh`. ### Impact Assessment Successful exploitation provides arbitrary local command execution under the account running the setup script. An attacker could: - Read or alter files available to that user. - Steal the Tencent COS credentials handled by t ...[truncated 351 chars]- Remediation
View remediation