T09 · Insecure Skill Coding Practices
Error
- Location
references/infrastructure-chaos.md:236- Finding
Root Command Injection Through Unsanitized Domain Input
- Content
View full analysis
> /etc/hosts' ], check=True) print(f"Blocked DNS for {domain}") yield finally: # Wait for duration time.sleep(duration_seconds) # Remove entry from /etc/hosts subprocess.run([ 'sudo', 'sed', '-i', f'/127.0.0.1 {domain}/d', '/etc/hosts' ], check=True) print(f"Restored DNS for {domain}") ``` ### Technical Analysis The caller-controlled `domain` value is interpolated into a command passed to `sudo sh -c`. Because the shell interprets the resulting string, command substitutions and other shell syntax embedded in `domain` are evaluated with root privileges. Double quotation marks do not prevent command substitution. For example, a domain containing `$(command)` can cause `command` to execute before the generated text is appended to `/etc/hosts`. The cleanup operation also inserts the unescaped domain into a `sed` expression. Although that call does not use a shell, specially crafted regular-expression or delimiter content can alter which lines are removed. The root shell exceeds the minimum privilege necessary for generating chaos-test configuration and creates a direct privilege-escalation path when the domain is not fully trusted. ### Attack Path 1. An attacker influences the domain supplied to `DNSChaos.block_domain()`. 2 ...[truncated 635 chars]- Remediation
View remediation