T09 · Insecure Skill Coding Practices
Warning
- Location
build.sh:12- Finding
PowerShell Command Injection Through Unvalidated Build Version
- Content
View full analysis
/dev/null 2>&1 || command -v powershell >/dev/null 2>&1; then PSH="$(command -v powershell.exe 2>/dev/null || command -v powershell)" WIN_SRC="$(cygpath -w "$(pwd)/$(basename "$STAGE_DIR")" 2>/dev/null || echo "$(pwd)/$(basename "$STAGE_DIR")")" WIN_OUT="$(cygpath -w "$OUT_DIR/$ZIP_NAME" 2>/dev/null || echo "$OUT_DIR/$ZIP_NAME")" "$PSH" -NoProfile -Command "Compress-Archive -Path '${WIN_SRC}' -DestinationPath '${WIN_OUT}' -Force" ``` ### Technical Analysis The first command-line argument is assigned directly to `VER` without validation. This value becomes part of `OUT_DIR`, `ZIP_NAME`, `STAGE_DIR`, and ultimately `WIN_OUT`. In the PowerShell fallback, `WIN_OUT` is interpolated into a PowerShell source-code string delimited by single quotes: ```powershell Compress-Archive -DestinationPath '${WIN_OUT}' ``` A version containing a single quote can terminate the PowerShell string and introduce additional statements. Shell quoting around `"$PSH"` does not protect the contents of the PowerShell `-Command` argument from interpretation by PowerShell itself. The absence of validation also permits path separators and traversal components in `VER`, potentially causing output or staging operations outside their intended directories. Exploitation is conditional on the build environment using the PowerShell archiving fallback. Systems where `zip` or `7z` is selected first do not follow the vulnerable PowerShell bra ...[truncated 1242 chars]- Remediation
View remediation
&2 exit 1 fi ``` 2. Reject path separators, traversal components, quotes, whitespace, shell metacharacters, and PowerShell metacharacters regardless of the version format. 3. Avoid constructing PowerShell source code through string interpolation. Pass paths as separately encoded arguments or environment variables and retrieve them as data inside PowerShell. 4. Canonicalize the output path and verify that it remains under the intended parent directory before creating files. 5. Add automated negative tests using versions containing: - Single and double quotes - `../` and `..\` - Semicolons and pipes - Newlines - PowerShell subexpressions 6. Run release builds under a minimally privileged account without access to unrelated production credentials. ]]>