T09 · Insecure Skill Coding Practices
Error
- Location
- rpa.py:248
- Finding
- Command Injection in Application Launching## Vulnerability Details **File Location**: `rpa.py:248-266` **Vulnerability Type**: OS command injection through unsafe shell invocation **Risk Level**: High ### Vulnerable Code ```python def cmd_launch(args): """启动应用""" app_paths = { "notepad": "notepad.exe", "word": "winword.exe", "excel": "excel.exe", "chrome": "chrome.exe", "firefox": "firefox.exe", "edge": "msedge.exe", "explorer": "explorer.exe", "cmd": "cmd.exe", "powershell": "powershell.exe", "paint": "mspaint.exe", "calc": "calc.exe", } app_path = app_paths.get(args.app.lower(), args.app) try: if args.args: subprocess.Popen(f'start "" "{app_path}" {args.args}', shell=True) else: subprocess.Popen(f'start "" "{app_path}"', shell=True) ``` ### Technical Analysis Both `args.app` and `args.args` are incorporated into a command string passed to `subprocess.Popen` with `shell=True`. On Windows, this causes the string to be interpreted by the command processor rather than executing a program directly. The `args.args` value is not quoted or escaped at all. Shell metacharacters such as `&`, `|`, redirection operators, and command-grouping syntax can therefore append or replace commands. The fallback behavior for `args.app` also permits an arbitrary caller-supplied value to enter the quoted command string. Embedded quotation marks can terminate that boundary and introduce additional shell syntax. ### Attack Path 1. An attacker, untrusted prompt, or compromised caller controls the `app` or `args` parameter of `desktop_launch_app`. 2. The value is substituted into the `start` command without shell-safe encoding. 3. A value containing command separators, such as an argument beginning with `&`, changes the command interpreted by `cmd.exe`. 4. `subprocess.Popen(..., shell=True)` exe ...[truncated 575 chars]
- Remediation
- ## Remediation Suggestions - Remove `shell=True` and invoke the executable with a structured argument list. - Resolve supported application aliases to fixed executable paths. - If custom applications must be supported, require an absolute path and validate it against an explicit allowlist of permitted directories or executables. - Parse application arguments into a list with a Windows-aware parser rather than concatenating them into a command. - Reject shell metacharacters when the requested operation does not legitimately require shell syntax. - Require explicit user approval before launching arbitrary executable paths. - Run application-launch operations in a restricted, non-administrative security context.