T09 · Insecure Skill Coding Practices
Note
- Location
run.sh:19- Finding
Option Injection Through User-Controlled Directory Path
- Content
View full analysis
/dev/null | sort -rh | head -20 echo "---" du -sh "$DIR_PATH" ``` ### Technical Analysis The user-controlled `DIR_PATH` value is passed to `du` without an explicit end-of-options marker (`--`). Shell quoting prevents shell metacharacters from causing command injection, but it does not prevent a relative path beginning with `-` from being interpreted as a command-line option by `du`. The initial directory validation does not mitigate this issue because directories can legally have names beginning with `-`. Both the directory itself and the paths generated by `"$DIR_PATH"/*` may therefore be parsed as options rather than operands. For example, GNU `du` supports options such as `--files0-from=FILE`. A crafted directory name and its contents could cause `du` to process paths supplied through an attacker-controlled file instead of limiting its operation to the requested directory. ### Attack Path 1. An attacker who can create files or directories in the current working directory creates a directory whose name begins with a valid `du` option. 2. If required by the chosen option, the attacker places supporting content inside that directory, such as a file containing additional paths for `du` to process. 3. The victim runs the script with the crafted relative directory name: ```bash bash run.sh '' ``` 4. The script confirms that the argument names an existing directory. 5. Because no `--` delimiter is used, `du` interprets the crafted path as an option and performs behavior different from the intended disk-usage query. ### Impact Assessment Exploitation occurs with the privileges of the user running the script. It can cause unexpected filesystem metadata traversal, disclosure of disk-usage information for unintend ...[truncated 373 chars]- Remediation
View remediation
/dev/null | sort -rh | head -20 echo "---" du -sh -- "$DIR_PATH" ``` Additional hardening measures include: 1. Resolve the supplied directory to a canonical absolute path before use, while handling resolution failures safely. 2. Preserve quoting around all path expansions. 3. Add regression tests using directory names such as `-a`, `--help`, and other valid option-like names. 4. Consider explicit handling for empty directories so that an unmatched glob is not passed literally to `du`. ]]>