T09 · Insecure Skill Coding Practices
Error
- Location
nex-vault.py:480- Finding
Shell Command Injection Through Telegram Configuration Input
- Content
View full analysis
> ~/.bashrc']) print("Telegram Bot Token saved. Run 'source ~/.bashrc' to apply.") print(FOOTER) elif args.action == 'set-telegram-chat': chat_id = input("Enter Telegram Chat ID: ") import subprocess subprocess.run(['bash', '-c', f'echo "export NEX_VAULT_TELEGRAM_CHAT_ID={chat_id}" >> ~/.bashrc']) ``` ### Technical Analysis The Telegram token and chat ID are accepted as untrusted interactive input and interpolated directly into commands executed by `bash -c`. Bash parses command substitutions, backticks, quote-breaking sequences, redirections, and other shell metacharacters in the resulting command. The apparent double quoting does not prevent command substitution. For example, an input containing `$(touch /tmp/nex-vault-pwned)` causes Bash to execute `touch` while evaluating the constructed command. A malicious value can also break out of the quoting context to run more complex commands. No format validation, shell escaping, or separation between data and executable shell syntax is applied. ### Attack Path 1. An attacker supplies or recommends a purported Telegram token or chat ID containing shell syntax. 2. The user or an automated Agent runs `nex-vault config set-telegram-token` or `nex-vault config set-telegram-chat`. 3. The malicious value is entered at the prompt. 4. The CLI interpolates it into the argument passed to `bash -c`. 5. Bash evaluates the injected command substitution or quote-breaking payload. 6. The payload executes with all privileges of the user running Nex Vault. A minimal command-substitution payload is: ```text $(touch /tmp/nex-vault-pw ...[truncated 504 chars]- Remediation
View remediation