T09 · Insecure Skill Coding Practices
Error
- Location
scripts/make-call.sh:104- Finding
Arbitrary Local Code Execution Through Python Source Injection
- Content
View full analysis
$MESSAGE" if [[ "$URGENT" == "true" ]]; then TWIML="${TWIML}This is an urgent message. Please respond immediately." fi TWIML="${TWIML}" # URL encode TwiML TWIML_ENCODED=$(python3 -c "import urllib.parse; print(urllib.parse.quote('''$TWIML'''))") ``` ### Technical Analysis The user-controlled `--message` and `--voice` arguments are incorporated into `TWIML`, which is then interpolated directly into Python source supplied through `python3 -c`. Triple-quoted Python strings do not make this safe. An attacker can include `'''` in an argument to terminate the string literal and append arbitrary Python statements. Because Python is executed locally before the Twilio request is sent, the injected statements execute with the operating-system privileges of the user or Agent invoking the Skill. For example, a message shaped like the following can break out of the generated Python literal: ```text '''); __import__('os').system('ATTACKER_COMMAND'); # ``` The final comment marker can suppress the remainder of the generated one-line Python program. ### Attack Path 1. An attacker obtains influence over a value passed to `--message` or `--voice`. This may occur directly or when an Agent incorporates external content into a call. 2. The attacker supplies a value that closes the `'''...'''` Python string. 3. The attacker appends a Python statement such as a call to `os.system`. 4. `scripts/make-call.sh` interpolates the malicious value into the `python3 -c` program. 5. Python executes the injected statement locally while URL-encoding the TwiML. 6. The injected process inherits the invoking user's permissions and environment. ### Impact ...[truncated 629 chars]- Remediation
View remediation