T09 · Insecure Skill Coding Practices
Error
- Location
molt-mouse.txt:17- Finding
Command Execution Through Unvalidated Arithmetic Environment Variable
- Content
View full analysis
max )) && v=$max (( v<-max )) && v=-$max echo "$v" } ``` An affected call site is: ```bash max="${MOLT_MOUSE_MAX_DELTA:-2000}" dx="$(clamp_int "$dx" "$max")" dy="$(clamp_int "$dy" "$max")" ``` Equivalent call sites occur in the `drag` and `drag-smooth` command implementations. ### Technical Analysis `MOLT_MOUSE_MAX_DELTA` is accepted from the inherited process environment without validation and is passed to `clamp_int`. Inside that function, the value is referenced as the arithmetic variable `max` in Bash arithmetic expressions: ```bash (( v>max )) (( v<-max )) ``` Bash arithmetic evaluation treats variable contents as arithmetic expressions and can recursively interpret expression syntax. Consequently, an attacker-controlled environment value is not handled strictly as an integer. A malicious arithmetic expression can trigger shell-side evaluation, including command substitution when crafted using an applicable Bash arithmetic expression structure. The user-provided mouse coordinates are validated with an integer regular expression, but the security-sensitive maximum value is not. This creates an environment-based command-injection boundary in the `move`, `drag`, and `drag-smooth` paths. Exploitation requires the attacker to influence the environment inherited by `molt-mouse`, such as through a compromised launcher, gateway configuration, service environment, or another process responsible for invoking the wrapper. ### Attack Path 1. The attacker obtains the ability to set or modify `MOLT_MOUSE_MAX_DELTA` in the environment inherited by the wrapper. 2. The attacker assigns a malicious Bash arithmetic ex ...[truncated 1117 chars]- Remediation
View remediation
= 1 && max <= 100000 )) || die "MOLT_MOUSE_MAX_DELTA is outside the permitted range" ``` Additional hardening measures should include: 1. Use a fixed default when an invalid value is encountered, or terminate safely. 2. Apply explicit lower and upper bounds to prevent excessive or nonsensical values. 3. Validate `MOLT_MOUSE_MIN_HOLD`, `MOLT_MOUSE_MAX_HOLD`, and `MOLT_MOUSE_STEP_SLEEP` before passing them to `awk` or `sleep`. 4. Start the gateway process with a minimal, explicitly constructed environment rather than inheriting arbitrary variables. 5. Add regression tests using malformed arithmetic expressions to ensure configuration values are always treated as plain numeric data. ]]>