T09 · Insecure Skill Coding Practices
Error
- Location
scripts/response-times.sh:5- Finding
Command Injection Through an Unvalidated Count Argument
- Content
View full analysis
/dev/null | \ grep -E "session state.*run_(started|completed)" | \ tail -$((COUNT * 2)) | \ awk ' ``` The value is reused without validation later in the script: ```bash ' | tail -$COUNT ``` ### Technical Analysis The first positional argument is assigned directly to `COUNT` without verifying that it is a decimal integer within an acceptable range. It is subsequently evaluated inside Bash arithmetic expansion: ```bash $((COUNT * 2)) ``` Bash arithmetic evaluation recursively interprets variable values as arithmetic expressions. Specially constructed input can therefore reach expression evaluation features, including array-subscript expansion and command substitution, rather than being handled only as a numeric count. The unquoted use in `tail -$COUNT` is also unsafe. It can cause word splitting, glob expansion, or option manipulation, depending on the supplied value. Although this secondary use is not itself a reliable shell-code reevaluation mechanism, it expands the input-handling attack surface. ### Attack Path 1. An attacker influences the argument passed to `scripts/response-times.sh`. 2. The script stores the argument unchanged in `COUNT`. 3. The expression `tail -$((COUNT * 2))` causes Bash to evaluate the attacker-controlled value as an arithmetic expression. 4. A crafted expression using arithmetic expansion behavior can trigger command substitution. 5. The injected command executes with the operating-system privileges and environment of the user running the Skill script. ### Impact Assessment Successful exploitation permits arbitrary com ...[truncated 550 chars]- Remediation
View remediation
1000 )); then printf 'Usage: %s [count: 1-1000]\n' "$0" >&2 exit 2 fi ``` Use the explicit `-n` option and quote each resulting argument: ```bash tail -n "$((COUNT * 2))" ``` ```bash tail -n "$COUNT" ``` Additional hardening should include: - Enable strict shell behavior where compatible, such as `set -euo pipefail`. - Treat every command-line argument as untrusted input. - Avoid placing unvalidated input in Bash arithmetic contexts. - Add regression tests covering alphabetic input, negative values, oversized values, whitespace, shell metacharacters, arithmetic expressions, and option-like strings. ]]>