T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/configure_backup.sh:290
- Finding
- Arbitrary Command Execution Through Sourced Backup Configuration## Vulnerability Details **File Location**: `scripts/configure_backup.sh:75-78, 290-303`; `scripts/manage_backup.sh:68-72, 134-138, 176-180, 205-209, 235-239` **Vulnerability Type**: Shell command injection through executable configuration **Risk Level**: High ### Vulnerable Code ```bash if [ -f "$CONFIG_FILE" ]; then source "$CONFIG_FILE" fi ``` ```bash cat > "$CONFIG_FILE" << EOF BACKUP_REPO_PATH=$BACKUP_PATH BACKUP_REMOTE_URL=$REMOTE_URL BACKUP_ENABLED=true LAST_BACKUP_TIME=$(get_beijing_time) EOF ``` The same writable configuration is repeatedly executed by the management script: ```bash source "$CONFIG_FILE" ``` ### Technical Analysis The configuration wizard accepts a user-controlled backup path and repository URL, writes those values into a shell script without safe serialization, and later loads the file using `source`. A sourced file is executable shell code, not passive configuration data. Consequently, shell syntax persisted in `BACKUP_REPO_PATH` or `BACKUP_REMOTE_URL` will be interpreted when the configuration is loaded. Quoting variables when they are subsequently used does not mitigate execution that already occurred during `source`. For example, a backup path containing a literal command substitution can result in a generated assignment equivalent to: ```bash BACKUP_REPO_PATH=$(attacker_command) ``` The command runs the next time `configure_backup.sh` or `manage_backup.sh` sources the file. ### Attack Path 1. An attacker or untrusted input channel supplies a custom backup path or repository URL containing shell syntax. 2. `configure_backup.sh` accepts the value and writes it into `.backup_config` as an unquoted shell assignment. 3. The user later invokes configuration or backup-management functionality. 4. The script executes `source "$CONFIG_FILE"`. 5. Bash interprets the injected syntax and executes the attacker-selected command with the privileges of the Agen ...[truncated 667 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the shell configuration file with a non-executable format such as JSON. 2. Parse individual fields with `jq`; never load writable configuration using `source`, `.`, or `eval`. 3. Validate backup paths as absolute paths under an explicitly approved parent directory. 4. Reject control characters, newlines, shell metacharacters, command substitutions, and unsupported URL schemes. 5. Write configuration atomically with restrictive permissions such as `0600`. 6. If a shell-compatible format is temporarily unavoidable, serialize every value with `printf '%q'`; this should be an interim measure rather than a substitute for structured parsing. 7. Treat existing `.backup_config` files as potentially unsafe and migrate them without sourcing their contents.