T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/send_otc_email.sh:33
- Finding
- Arbitrary Python Code Execution Through Operation and Session Inputs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/send_otc_email.sh:33-41` **Vulnerability Type**: Python source-code injection **Risk Level**: Critical ### Vulnerable Code ```bash # Auto-detect language if not specified if [ "$LANG_PREF" = "auto" ]; then if LC_ALL=C grep -q '[一-龥]' <<< "$OPERATION$SESSION" 2>/dev/null || \ python3 -c "import sys; sys.exit(0 if any('\u4e00' <= c <= '\u9fff' for c in '''$OPERATION$SESSION''') else 1)" 2>/dev/null; then LANG_PREF="zh" else LANG_PREF="en" fi fi ``` ### Technical Analysis `OPERATION` and `SESSION` are caller-controlled arguments interpolated directly into source code passed to `python3 -c`. Enclosing the values in Python triple quotes does not safely escape triple quotes, backslashes, or other Python syntax present in the input. An attacker who can influence either argument can terminate the embedded string and introduce additional Python statements. The injected statements execute during language detection, before the one-time confirmation email is sent or verified. Shell quoting does not prevent this vulnerability because the shell first constructs one argument containing the attacker-influenced Python program, which the Python interpreter then evaluates as code. ### Attack Path 1. An attacker supplies or induces an Agent to process a malicious operation description or session identifier. 2. The Agent invokes `send_otc_email.sh` with that text and leaves the language preference at its default value of `auto`. 3. The malicious value closes the Python triple-quoted string and appends Python statements. 4. `python3 -c` parses and executes the injected statements. 5. The injected code runs with the same operating-system identity, environment variables, filesystem permissions, and network access as the Agent process. ### Impact Assessment Successful exploitation provides arbitrary local code execution under the Agent's account. Depending on the Agent's privileges, this may exp ...[truncated 317 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Never interpolate untrusted data into Python source code. Pass the text as a positional argument or through standard input: ```bash if python3 -c ' import sys text = sys.argv[1] sys.exit(0 if any("\u4e00" <= c <= "\u9fff" for c in text) else 1) ' "$OPERATION$SESSION"; then LANG_PREF="zh" else LANG_PREF="en" fi ``` Alternatively, perform Unicode detection entirely in a fixed helper script. Add regression tests containing triple quotes, backslashes, newlines, semicolons, and other Python metacharacters. Language detection should fail closed without evaluating input as source code. ]]>