T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/install-arthas.sh:25
- Finding
- Remote Shell Command Injection Through Unvalidated Installation Parameters<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install-arthas.sh`, lines 25-71 **Vulnerability Type**: Remote shell command injection **Risk Level**: High ### Vulnerable Code ```bash SSH_HOST="$1" SSH_USER="$2" SSH_PASS="$3" ARTHAS_DIR="$4" PROCESS_NAME="$5" # Check whether Arthas is installed CHECK_RESULT=$(sshpass -p "$SSH_PASS" ssh "$SSH_USER@$SSH_HOST" "ls -la $ARTHAS_DIR/arthas-boot.jar 2>/dev/null || echo NOT_FOUND") if [[ "$CHECK_RESULT" != *"NOT_FOUND"* ]]; then echo "Arthas is installed: $ARTHAS_DIR/arthas-boot.jar" else sshpass -p "$SSH_PASS" ssh "$SSH_USER@$SSH_HOST" "mkdir -p $ARTHAS_DIR && cd $ARTHAS_DIR && curl -O https://arthas.aliyun.com/arthas-boot.jar" fi JAVA_PID=$(sshpass -p "$SSH_PASS" ssh "$SSH_USER@$SSH_HOST" "ps -ef | grep java | grep $PROCESS_NAME | grep -v grep | awk '{print \$2}' | head -1") ATTACHED=$(sshpass -p "$SSH_PASS" ssh "$SSH_USER@$SSH_HOST" "ps -ef | grep arthas | grep $JAVA_PID | grep -v grep || echo NOT_ATTACHED") sshpass -p "$SSH_PASS" ssh "$SSH_USER@$SSH_HOST" "cd $ARTHAS_DIR && nohup java -jar arthas-boot.jar $JAVA_PID --target-ip 0.0.0.0 --http-port 8563 > arthas.log 2>&1 &" ``` ### Technical Analysis The script places `ARTHAS_DIR` and `PROCESS_NAME`, which are supplied as positional command-line arguments, directly inside double-quoted command strings sent to a remote shell over SSH. Local assignment quoting does not make these values safe after interpolation into the remote command. Shell metacharacters such as semicolons, command substitutions, pipes, redirections, and logical operators can alter the command interpreted by the remote shell. The vulnerable variables are used in several command contexts: - `ARTHAS_DIR` is inserted into `ls`, `mkdir`, `cd`, `java`, and log-file paths. - `PROCESS_NAME` is inserted into a shell pipeline containing `grep`. - Values derived through these commands are later reused in additional remote commands. No allowlist validation or shell-safe remote ...[truncated 1088 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate all externally supplied parameters against strict allowlists: - Restrict process names to expected alphanumeric characters, periods, underscores, and hyphens. - Require the installation directory to be an absolute path and reject shell metacharacters. 2. Do not build remote shell commands through direct interpolation. 3. Pass values as positional parameters to a fixed remote script, for example by invoking `sh -s --` and reading arguments as `$1`, `$2`, and so on. 4. If shell command construction cannot be avoided, apply a well-tested shell-escaping routine to every interpolated value. 5. Replace `ps | grep` process matching with a safer mechanism such as `pgrep` and pass the pattern as a separately quoted argument. 6. Reject empty values, control characters, newline characters, command substitutions, redirections, and shell operators. 7. Avoid using a privileged SSH account. Run the installer under a dedicated account with only the permissions required to attach to the intended JVM. ]]>