T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup_cron.sh:17- Finding
Unvalidated Cron Schedule Enables Persistent Command Injection
- Content
View full analysis
> $LOG_DIR/monitor.log 2>&1 $CRON_MARKER" (crontab -l 2>/dev/null | grep -v "$CRON_MARKER" || true; echo "$CRON_JOB") | crontab - ``` ### Technical Analysis The script reads the `schedule` property from `config.json` and inserts it directly at the beginning of a crontab entry. It does not verify that the value: - Is a string containing only one line. - Contains exactly the expected cron scheduling fields. - Does not contain an embedded command after the scheduling fields. - Does not contain carriage returns, newline characters, NUL bytes, or other control characters. - Does not use cron directives or special syntax outside the supported schedule format. A crontab line consists of scheduling fields followed by an arbitrary shell command. Consequently, an attacker-controlled schedule can place a command immediately after valid scheduling fields, causing the intended monitor command to become additional shell syntax. Newline characters can also create entirely separate cron entries. For example, a malicious configuration could use a value conceptually equivalent to: ```json { "schedule": "* * * * * attacker_command #" } ``` After concatenation, the resulting entry would execute `attacker_command`, while the comment character prevents the intended monitoring command from affecting execution. A multiline value could install additional independent scheduled jobs. The exploit requires the attacker to influence `config.json` before a u ...[truncated 1731 chars]- Remediation
View remediation