T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/fear-greed.sh:7
- Finding
- Remote API Data Is Evaluated in Bash Arithmetic Without Validation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fear-greed.sh`, lines 7-18 **Vulnerability Type**: Arithmetic injection through untrusted remote data **Risk Level**: High ### Vulnerable Code ```bash # Fetch data DATA=$(curl -s "$PRISM_URL/market/fear-greed") VALUE=$(echo "$DATA" | jq -r '.value // 50') LABEL=$(echo "$DATA" | jq -r '.label // "Neutral"') # JSON output if [ "$1" == "--json" ]; then echo "$DATA" exit 0 fi # Calculate bar BAR_FILLED=$((VALUE / 5)) BAR_EMPTY=$((20 - BAR_FILLED)) ``` ### Technical Analysis The script obtains `VALUE` from a remotely supplied JSON response and passes it directly into Bash arithmetic expansion: ```bash BAR_FILLED=$((VALUE / 5)) ``` Bash arithmetic expressions do not provide a strict numeric parsing boundary. Variable values may be recursively interpreted as arithmetic expressions, making untrusted values unsafe unless they are first validated as decimal integers. A malicious response can therefore supply arithmetic syntax rather than a number. Depending on the supplied expression and Bash evaluation behavior, this can result in unexpected expression evaluation, command substitution, or denial of service. The endpoint can also return negative or excessively large numbers. Such values make `BAR_FILLED` or `BAR_EMPTY` invalid for their subsequent use with `seq`, potentially producing errors, excessive output, or resource consumption. The risk is reachable through either compromise of the default PRISM service or configuration of `PRISM_URL` to an attacker-controlled server. The use of `curl -s` also suppresses useful error output and does not fail on HTTP error statuses, while no connection or total timeout is configured. ### Attack Path 1. An attacker gains control of the configured PRISM endpoint, compromises the default service, or causes the user to configure an attacker-controlled `PRISM_URL`. 2. The attacker returns valid JSON whose `.value` field contains a crafted arithmetic expressi ...[truncated 1106 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require the extracted JSON value to be a JSON number and validate it before arithmetic use: ```bash if ! VALUE=$(jq -er '.value | select(type == "number" and floor == . and . >= 0 and . <= 100)' <<<"$DATA"); then printf '%s\n' "Error: API returned an invalid fear-and-greed value." >&2 exit 1 fi ``` 2. Alternatively, apply a strict shell-level decimal validation and range check: ```bash if [[ ! $VALUE =~ ^[0-9]+$ ]] || (( VALUE < 0 || VALUE > 100 )); then printf '%s\n' "Error: value must be an integer from 0 to 100." >&2 exit 1 fi ``` 3. Convert validated input explicitly as base 10 before using it: ```bash VALUE_NUM=$((10#$VALUE)) BAR_FILLED=$((VALUE_NUM / 5)) BAR_EMPTY=$((20 - BAR_FILLED)) ``` 4. Harden network handling with failure detection and time limits: ```bash if ! DATA=$(curl --fail --silent --show-error \ --connect-timeout 5 --max-time 15 \ "$PRISM_URL/market/fear-greed"); then printf '%s\n' "Error: failed to retrieve market data." >&2 exit 1 fi ``` 5. Validate `.label` as a string and constrain its length before displaying it. Consider using a locally derived label based on the validated numeric value rather than trusting remote display content. 6. Add automated tests covering strings, objects, arrays, null values, negative values, values above 100, extremely large integers, and crafted arithmetic expressions. ]]>