T09 · Insecure Skill Coding Practices
Error
- Location
lib/modules.py:489- Finding
Configuration-Controlled Arbitrary Shell Command Execution
- Content
View full analysis
Dict[str, Any]: """ Run arbitrary shell command. """ try: command = config.get("command") if not command: return { "title": "Custom Command", "content": "No command specified", "status": "error", "items": [], } result = subprocess.run( command, shell=True, capture_output=True, text=True, timeout=10, ) items = result.stdout.split("\n") if result.stdout else [] status = "error" if result.returncode != 0 else "ok" ``` ### Technical Analysis The CUSTOM module passes the `command` configuration value directly to `subprocess.run()` with `shell=True`. Consequently, shell metacharacters, command substitutions, pipelines, redirects, and chained commands are interpreted by the operating-system shell. Arbitrary command execution is documented as a feature, but using `shell=True` exceeds the minimum mechanism required to launch a configured executable. More importantly, report module configurations are loaded from the mutable SQLite database without integrity validation or revalidation at execution time. A process or local user capable of changing `~/.nex-reports/reports.db` can inject a CUSTOM module or replace its command. The ten-second timeout does not provide a security boundary. A command can modify files, access credentials available to the account, transmit data, or launch a detached process before the timeout expires. ### Attack Path 1. An attacker obtains write access to `~/.nex-reports/reports.db`, such as through permissive file permissions, a compromised process running as the user, or a ...[truncated 1290 chars]- Remediation
View remediation