T09 · Insecure Skill Coding Practices
Error
- Location
scripts/install.sh:7- Finding
Privileged Command Injection Through an Unquoted Installation Path
- Content
View full analysis
/dev/null; then echo "❌ fail2ban not installed. Run: sudo apt install -y fail2ban" exit 1 fi if ! command -v jq &>/dev/null; then echo "❌ jq not installed. Run: sudo apt install -y jq" exit 1 fi # Verify API key exists API_KEY="${ABUSEIPDB_KEY:-$(pass show abuseipdb/api-key 2>/dev/null || echo "")}" if [ -z "$API_KEY" ]; then echo "❌ No AbuseIPDB API key found." echo " Get one free at: https://www.abuseipdb.com/account/api" echo " Then run: pass insert abuseipdb/api-key" exit 1 fi # Create fail2ban action cat > /etc/fail2ban/action.d/abuseipdb.conf << CONF [Definition] actionban = bash $SCRIPT_DIR/report-single.sh "SSH brute-force on jail (fail2ban auto-report)" [Init] CONF ``` ### Technical Analysis The script determines `SCRIPT_DIR` from the directory in which the installer is located and directly interpolates that value into an `actionban` command: ```bash actionban = bash $SCRIPT_DIR/report-single.sh ... ``` Although the path is quoted while it is calculated, it is not quoted or safely escaped when written into the fail2ban action configuration. Fail2ban action commands are ultimately interpreted as shell commands. Consequently, shell metacharacters, whitespace, command separators, or substitutions contained in the project directory name can change the meaning of the generated command. For example, placing the project in a directory whose name contains a sequence such as `; id; #` causes that sequence to be preserved in `/etc/fail2ban/action.d/abuseipdb.conf`. When fail2ban subsequently executes the action, the injected `id` command is treated as a separate shell command rather than as part of the scr ...[truncated 1915 chars]- Remediation
View remediation
"SSH brute-force on jail (fail2ban auto-report)" ``` 3. **Quote and escape any path that must remain dynamic.** Use a shell-escaping routine rather than ordinary double quotes alone. Fail2ban placeholder processing must also be considered when generating the final command. 4. **Reject unsafe installation paths as defense in depth.** Abort if `SCRIPT_DIR` contains characters outside a conservative allowlist, such as letters, digits, underscores, hyphens, periods, and path separators. 5. **Verify ownership and permissions before installation.** Refuse to install executable files from directories writable by unprivileged users. 6. **Write configuration atomically and validate it before restarting fail2ban.** Create the configuration with restrictive permissions, run fail2ban configuration validation, and only then replace the active file and restart the service. ]]>