T09 · Insecure Skill Coding Practices
Error
- Location
scripts/deploy.sh:21- Finding
Unvalidated Service Name Enables Broad Regex-Based Process Termination
- Content
View full analysis
/dev/null | grep -q "$SVC"; then echo " target: systemd service '$SVC' via sudo systemctl restart" if [ "$DRY" = "1" ]; then echo " [dry-run] no changes made"; exit 0; fi read -r -p " Restart systemd service '$SVC'? [y/N] " ans [ "$ans" = "y" ] || [ "$ans" = "Y" ] || { echo " cancelled"; exit 1; } sudo systemctl restart "$SVC" && echo " systemd: restarted" else echo " target: kill matching processes (pkill -f '$SVC') + relaunch via nohup" if [ "$DRY" = "1" ]; then echo " [dry-run] no changes made"; exit 0; fi read -r -p " Kill processes matching '$SVC' and relaunch? [y/N] " ans [ "$ans" = "y" ] || [ "$ans" = "Y" ] || { echo " cancelled"; exit 1; } pkill -f "$SVC" 2>/dev/null; sleep 2 ``` ### Technical Analysis The service name is accepted directly from a command-line argument and is not restricted to a safe service-name syntax. It is passed to both `grep` and `pkill -f`, where it is interpreted as a regular expression rather than as a literal, exact service identifier. The systemd detection is therefore unreliable: a crafted expression may match an unrelated unit and direct execution into the wrong branch. If no unit is detected, `pkill -f` applies the attacker-controlled expression to complete process command lines. Expressions such as `.*`, broad substrings, or deliberately constructed alternatives can match and terminate numerous unrelated processes. The confirmation prompt reduces accidental execution but does not neutralize the vulnerability. An operator may approve the action based on the displayed service name without understanding that it is a regular expression or that `pkill -f` can match unrelated command lines. ### Attack Path 1. An a ...[truncated 1247 chars]- Remediation
View remediation
&2 exit 2 ;; esac ``` 2. Query systemd using an exact unit name rather than parsing `list-units` with a regular expression: ```bash UNIT="${SVC%.service}.service" if systemctl show "$UNIT" >/dev/null 2>&1; then sudo systemctl restart "$UNIT" fi ``` 3. Do not use `pkill -f` for service lifecycle management. Prefer systemd, another process supervisor, or a securely maintained PID file. 4. If a PID file is used, place it in a private runtime directory, verify that it is a regular file owned by the expected user, validate that its content is a numeric PID, and confirm the process identity before sending a signal. 5. If literal process matching is unavoidable, avoid regular-expression interpretation and ensure the match uniquely identifies the intended executable. Operator confirmation should remain as defense in depth, not as the primary security control. ]]>