T09 · Insecure Skill Coding Practices
Error
- Location
scripts/install-arthas.sh:25- Finding
Remote Shell Command Injection Through Unvalidated Installation Parameters
- Content
View full analysis
/dev/null || echo NOT_FOUND") if [[ "$CHECK_RESULT" != *"NOT_FOUND"* ]]; then echo "Arthas is installed: $ARTHAS_DIR/arthas-boot.jar" else sshpass -p "$SSH_PASS" ssh "$SSH_USER@$SSH_HOST" "mkdir -p $ARTHAS_DIR && cd $ARTHAS_DIR && curl -O https://arthas.aliyun.com/arthas-boot.jar" fi JAVA_PID=$(sshpass -p "$SSH_PASS" ssh "$SSH_USER@$SSH_HOST" "ps -ef | grep java | grep $PROCESS_NAME | grep -v grep | awk '{print \$2}' | head -1") ATTACHED=$(sshpass -p "$SSH_PASS" ssh "$SSH_USER@$SSH_HOST" "ps -ef | grep arthas | grep $JAVA_PID | grep -v grep || echo NOT_ATTACHED") sshpass -p "$SSH_PASS" ssh "$SSH_USER@$SSH_HOST" "cd $ARTHAS_DIR && nohup java -jar arthas-boot.jar $JAVA_PID --target-ip 0.0.0.0 --http-port 8563 > arthas.log 2>&1 &" ``` ### Technical Analysis The script places `ARTHAS_DIR` and `PROCESS_NAME`, which are supplied as positional command-line arguments, directly inside double-quoted command strings sent to a remote shell over SSH. Local assignment quoting does not make these values safe after interpolation into the remote command. Shell metacharacters such as semicolons, command substitutions, pipes, redirections, and logical operators can alter the command interpreted by the remote shell. The vulnerable variables are used in several command contexts: - `ARTHAS_DIR` is inserted into `ls`, `mkdir`, `cd`, `java`, and log-file paths. - `PROCESS_NAME` is inserted into a shell pipeline containing `grep`. - Values derived through these commands are later reused in additional remote commands. No allowlist validation or shell-safe remote ...[truncated 1088 chars]- Remediation
View remediation