T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/scaffold.sh:239
- Finding
- Command Injection Through Unvalidated Project Name in GNU sed<![CDATA[ ## Vulnerability Details **File Location**: `scripts/scaffold.sh`, source at line 7 and injection sink at line 239 **Vulnerability Type**: Command injection through dynamically constructed sed program **Risk Level**: High ### Vulnerable Code ```bash NAME="${1:?Usage: ./scaffold.sh <name> [--node] [--python] [--go]}" ``` ```bash sed -i "s/APPNAME/$NAME/g" main.go ``` ### Technical Analysis The project name is accepted without validation and inserted directly into a double-quoted GNU `sed` program. Shell quoting prevents ordinary shell word splitting but does not prevent `sed` from interpreting attacker-controlled delimiters, commands, flags, backslashes, or newline characters. A crafted project name can terminate the intended substitution expression and introduce an additional GNU `sed` command. In particular, GNU sed's `e` command can execute a local shell command. This behavior is unnecessary for scaffolding a Go module and violates least-privilege design. ### Attack Path 1. An attacker supplies or recommends a specially crafted project name containing sed delimiters and embedded newline characters. 2. A victim invokes `scaffold.sh` with that name and the `--go` option. 3. Line 7 stores the value in `NAME` without checking its character set. 4. The script creates and enters the corresponding path. 5. Line 239 incorporates the value into the sed program. 6. GNU sed interprets the injected content as an additional command rather than replacement text. 7. An injected `e` command executes under the account running the scaffold script. ### Impact Assessment Successful exploitation provides arbitrary command execution with the invoking user's privileges. The attacker could read or modify user-accessible files, alter source repositories, access credentials available to that account, install user-level persistence, or run network commands. The script itself does not request elevated privileges, so the direct scope is normally the current user; runni ...[truncated 73 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate `NAME` before using it in paths or generated source: ```bash if [[ ! "$NAME" =~ ^[a-z0-9][a-z0-9_-]*$ ]]; then printf 'Error: project name must contain only lowercase letters, digits, underscores, and hyphens.\n' >&2 exit 2 fi ``` 2. Do not build a sed program from untrusted input. Generate `main.go` directly with a controlled heredoc or use a replacement mechanism that treats the name strictly as data. 3. If sed remains necessary, escape every sed-significant character, including the delimiter, backslash, ampersand, and newline. Validation should still be retained as the primary control. 4. Reject control characters and path separators independently. 5. Add regression tests using delimiters, backslashes, ampersands, newline characters, sed commands, and shell metacharacters. 6. Run the scaffold script only with ordinary user privileges. ]]>