T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cli/hooks/pre/EcsSendFile.py:67- Finding
Shell Injection in Oversized ECS File Transfer
- Content
View full analysis
&2; exit 1; fi' ) lines.append(f'curl -sSfL -o "{target_path}" "{url}"') if file_mode: lines.append(f'chmod "{file_mode}" "{target_path}"') ``` Additional vulnerable interpolation occurs at `scripts/cli/hooks/pre/EcsSendFile.py:85-88`: ```python if file_owner or file_group: owner = file_owner or "" group = file_group or "" lines.append(f'chown "{owner}:{group}" "{target_path}"') ``` ### Technical Analysis When file content exceeds 32,000 characters, the hook uploads the content to OSS and constructs a shell script that is subsequently submitted to `EcsRunCommandSync`. The user-controlled values `targetDir`, `name`, `fileMode`, `fileOwner`, and `fileGroup` are inserted directly into shell commands. Enclosing a value in double quotes does not neutralize shell command substitution, embedded quotes, backticks, newlines, or other shell syntax. For example, a value containing `$(command)` remains executable inside double quotes. No strict allowlist validation or shell-safe quoting is applied before constructing the script. The injected script is then executed on every ECS instance listed in `instanceIds`. ### Attack Path 1. An attacker or untrusted deployment input supplies file content exceeding the 32,000-character threshold. 2. The attacker places shell syntax in a file-transfer field, such as: ```text targetDir=/tmp/$(malicious-command) ``` 3. `EcsSendFile.py` interpolates the value into: ```bash mkdir -p "/tmp/$(malicious-com ...[truncated 1162 chars]- Remediation
View remediation