T09 · Insecure Skill Coding Practices
Error
- Location
scripts/config_backup.py:15- Finding
OS Command Injection Through Shell-Interpolated SSH Parameters
- Content
View full analysis
str: """Execute command on IAP via SSH""" try: cmd = f'echo "{self.password}" | sshpass -p stdin ssh -o StrictHostKeyChecking=no -o ConnectTimeout=30 {self.username}@{self.ap_ip} "{command}"' result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=60) return result.stdout ``` `scripts/diagnose_iap.py:16-27`: ```python def __init__(self, ap_ip: str, username: str = "aruba", password: str = "aruba123"): self.ap_ip = ap_ip self.username = username self.password = password self.ssh_cmd = f"ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 {self.username}@{self.ap_ip}" def run_ssh_command(self, command: str) -> str: """Execute command on IAP via SSH""" try: # Use sshpass for password authentication if available cmd = f'echo "{self.password}" | sshpass -p stdin ssh {self.username}@{self.ap_ip} "{command}"' result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30) return result.stdout ``` `scripts/monitor_clients.py:17-29`: ```python def __init__(self, ap_ip: str, username: str = "aruba", password: str = "aruba123"): self.ap_ip = ap_ip self.username = username self.password = password def run_ssh_command(self, command: str) -> str: """Execute command on IAP via SSH""" try: cmd = f'echo "{self.password}" | sshpass -p stdin ssh -o StrictHostKeyCh ...[truncated 2400 chars]- Remediation
View remediation