T09 · Insecure Skill Coding Practices
Error
- Location
scripts/analyst.sh:42- Finding
Remote API Response Is Interpolated into Executable Python Source
- Content
View full analysis
/dev/null || echo "False") PAYOUT=$(echo "$RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin).get('payout', 0))" 2>/dev/null || echo "0") TOTAL_WAGERED=$((TOTAL_WAGERED + BET)) if [ "$WON" = "True" ]; then WINS=$((WINS + 1)) TOTAL_PAYOUT=$(python3 -c "print($TOTAL_PAYOUT + $PAYOUT)") ``` ### Technical Analysis The `payout` property is extracted from a remote JSON response and stored in `PAYOUT`. Instead of passing that value to Python as data, line 49 directly interpolates it into the source code supplied to `python3 -c`. JSON parsing does not enforce that `payout` is numeric. If the endpoint returns a string containing valid Python syntax, `print()` emits the string without quotation marks. The emitted value is subsequently inserted into a new Python program and evaluated as code. HTTPS reduces the likelihood of network tampering but does not make remote response data safe for source-code interpolation. Exploitation remains possible if the external service is compromised, behaves maliciously, or its trusted network path is subverted. ### Attack Path 1. The script submits a bet to `https://agent.rollhub.com/api/v1/bet`. 2. An attacker with control over the API response returns a `payout` property containing a crafted Python expression. 3. The first Python command parses the JSON and prints that property as text. 4. The shell stores the attacker-controlled text in `PAYOUT`. 5. Line 49 constructs a new `python3 -c` program containing that text. 6. Python evaluates the injected expression, allowing operating-system commands or arbitrary Python operations to run. ### Impact Assessment Successful exploitation provides ...[truncated 483 chars]- Remediation
View remediation