T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/devialet.sh:131
- Finding
- Command Execution Through Unsafe Bash Arithmetic Evaluation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/devialet.sh:131-134` **Vulnerability Type**: Shell arithmetic injection **Risk Level**: High ### Vulnerable Code ```bash if [[ "$ARG" -lt 0 || "$ARG" -gt 100 ]]; then echo "Error: Volume must be 0-100" exit 1 fi ``` ### Technical Analysis The third command-line argument is assigned directly to `ARG` and then evaluated by Bash arithmetic comparison operators: ```bash ARG="${3:-}" ``` The `-lt` and `-gt` operators place their operands in an arithmetic evaluation context. Bash arithmetic expressions can recursively resolve variable references and evaluate array subscripts. A value containing a crafted arithmetic expression may therefore cause command substitutions embedded in an array subscript to execute. The code checks only whether the resulting arithmetic value is between 0 and 100. It does not first require the input to consist exclusively of decimal digits. ### Attack Path 1. An attacker obtains the ability to invoke the script or influence the volume argument passed by an automation layer. 2. The attacker supplies a malicious arithmetic expression instead of an ordinary numeric volume, for example an expression containing a command substitution in an array subscript. 3. The expression reaches the following comparison without lexical validation: ```bash [[ "$ARG" -lt 0 || "$ARG" -gt 100 ]] ``` 4. Bash evaluates the expression and executes the embedded command substitution. 5. The command runs with the operating-system privileges and environment of the user executing the Skill. This is a local command-execution path. Exploitation requires control over the volume argument but does not require modifying the script. ### Impact Assessment Successful exploitation can execute arbitrary shell commands with the privileges of the Skill process. This could permit access to the invoking user's files and credentials, modification of user-owned data, outbound network access, and ...[truncated 180 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Require a strict decimal representation before entering any arithmetic context: ```bash if [[ ! "$ARG" =~ ^[0-9]+$ ]]; then echo "Error: Volume must be an integer from 0 to 100" exit 1 fi if (( 10#$ARG > 100 )); then echo "Error: Volume must be an integer from 0 to 100" exit 1 fi ``` The `10#` prefix forces base-10 interpretation and avoids octal handling of values with leading zeroes. Apply the same strict validation to every user-controlled value used in arithmetic expressions or JSON request bodies. ]]>