T09 · Insecure Skill Coding Practices
Error
- Location
- tiktok_bot.py:445
- Finding
- Android Shell Command Injection Through the Video URL<![CDATA[ ## Vulnerability Details **File Location**: `tiktok_bot.py:445-455` **Vulnerability Type**: OS command injection through an ADB shell command **Risk Level**: High ### Vulnerable Code ```python if video_url.startswith("http://") or video_url.startswith("https://"): # Download video from URL print(f"\n📥 Downloading video from URL...") # Use unique timestamp filename for identification timestamp = int(time.time()) device_video_path = f"/sdcard/DCIM/Camera/video_{timestamp}.mp4" # Use curl to download directly to device curl_result = subprocess.run( ["adb", "-s", device_id, "shell", f"curl -L -o {device_video_path} '{video_url}'"], capture_output=True, timeout=300 # 5 minutes for download ) ``` ### Technical Analysis The `--video` argument is accepted as an arbitrary string. When it begins with `http://` or `https://`, it is interpolated into a command string that is passed to Android's shell through `adb shell`. Using a list for the host-side `subprocess.run()` invocation does not prevent this vulnerability because the final list element is explicitly interpreted by the remote Android shell. The URL is enclosed in single quotes, but embedded single quotes are neither rejected nor escaped. An attacker can terminate the quoted URL and append additional shell commands. The scheme-prefix check is not a security boundary. A malicious value can begin with `https://` and still contain shell syntax later in the string. ### Attack Path 1. The attacker gains the ability to invoke the CLI or influence the `--video` argument. 2. The attacker supplies an HTTPS-prefixed value containing a single quote followed by shell operators and an Android command. 3. `publish_mode()` embeds the value into the device-side `curl` command. 4. `adb shell` passes the resulting string to Android's command interpreter. 5. The injected command executes with the privileges granted to the ADB shell user. For example, the ...[truncated 819 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not construct device-side shell commands from user-controlled URLs. 2. Download the media on the host with a maintained HTTP client using: - An explicit `https` scheme allowlist. - Connection and read timeouts. - Redirect limits. - Maximum response-size limits. - Content-type and media-format validation. 3. Save the response to a securely created host-side temporary file and transfer it with argument-based `adb push`. 4. If device-side downloading is unavoidable, reject all shell metacharacters and apply robust shell quoting rather than manually surrounding the value with quotes. 5. Consider restricting remote hosts to an administrator-defined allowlist. 6. Add tests using quotes, semicolons, command substitutions, newlines, and other shell metacharacters. ]]>