T09 · Insecure Skill Coding Practices
Error
- Location
scripts/filed.sh:131- Finding
Arbitrary Python Code Execution Through Unsafe Query Encoding
- Content
View full analysis
/dev/null || echo "$name")" [[ -n "$agent" ]] && url+="&agent=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$agent'))" 2>/dev/null || echo "$agent")" [[ -n "$officer" ]] && url+="&officer=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$officer'))" 2>/dev/null || echo "$officer")" ``` ### Technical Analysis The values supplied through `--name`, `--agent`, and `--officer` are inserted directly into Python source code executed using `python3 -c`. Although the shell variables are expanded within a shell-quoted argument, the expanded result is subsequently interpreted as Python program text. An attacker can include a single quote in an option value to terminate the intended Python string literal, append arbitrary Python statements, and comment out the remaining generated source. For example, a value structurally equivalent to the following can escape the intended string: ```text '); __import__("os").system("ATTACKER_COMMAND"); # ``` This causes the dynamically constructed Python program to invoke an attacker-selected operating-system command rather than merely URL-encoding the supplied value. The issue affects all three query parameters processed in this manner. The fallback `|| echo "$name"` does not mitigate the vulnerability because injected commands can execute before `python3` exits. It also returns unencoded input when Python is unavailable or fails, which can produce malformed or attacker-influenced query strings. ### Attack Path 1. An attacker influences a value passed to `filed.sh search` through `--name`, `--agent`, or `--officer`. 2. The script interpolates that value into t ...[truncated 1381 chars]- Remediation
View remediation