T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mtr_ecs.py:369- Finding
Remote Shell Command Injection Through the Diagnostic Target
- Content
View full analysis
str: """Build the MTR diagnostic script for remote execution.""" lines = [ "#!/bin/bash", "set -e", "", "# Check mtr availability (installation is handled by the install-mtr subcommand separately)", "if ! which mtr >/dev/null 2>&1; then", ' echo "ERROR: mtr is not installed. Please use the install-mtr subcommand first."', " exit 1", "fi", "", "# ICMP MTR", 'echo "===ICMP_MTR_START==="', f"mtr -r -c {count} -n {target}", 'echo "===ICMP_MTR_END==="', "", ] if tcp_port: lines.extend([ "# TCP MTR", 'echo "===TCP_MTR_START==="', f"mtr --tcp -P {tcp_port} -r -c {count} {target}", 'echo "===TCP_MTR_END==="', "", ]) lines.extend([ "# Ping test", 'echo "===PING_START==="', f"ping -c 20 {target} 2>&1 || true", 'echo "===PING_END==="', "", ]) if tcp_port: lines.extend([ "# Curl test (HTTP)", 'echo "===CURL_START==="', f"curl -o /dev/null -s -w 'HTTP_CODE=%{{http_code}} TIME=%{{time_total}}s CONNECT=%{{time_connect}}s' " f"--connect-timeout 10 --max-time 30 http://{target}:{tcp_port}/ 2>&1 || true", 'echo "===CURL_END==="', ]) return "\n".join(lines) ``` ### Technical Analysis The `target` argument is inserted directly into multiple shell command strings without strict validation or shell escaping. The generated script is submitted to Alibaba Cloud Cloud Assistant and executed by a shell on the selected ECS instance. ...[truncated 1768 chars]- Remediation
View remediation