T09 · Insecure Skill Coding Practices
Error
- Location
github-readme-generator.sh:154- Finding
<![CDATA[Command Injection Through Unescaped GNU sed Expressions]]>
- Content
View full analysis
README.md echo -e "${GREEN}✅ README.md generated successfully!${NC}" echo "Project: $NAME" echo "Template: $TEMPLATE" ``` ### Technical Analysis The user-controlled `NAME` and `DESCRIPTION` values, as well as the environment-derived `AUTHOR_NAME`, are inserted directly into double-quoted `sed` programs. They are not escaped as replacement data before being interpreted by `sed`. Characters such as `/`, `\`, `&`, and embedded newlines can change the structure of the generated `sed` program. On GNU `sed`, an attacker can use an embedded newline to terminate the substitution command and introduce an `e` command, which executes a shell command. The remaining generated syntax can be neutralized with a `sed` comment. This is not ordinary shell metacharacter injection through Bash expansion—the shell does not reparse expansion results as shell syntax. Instead, it is injection into the secondary GNU `sed` command language, whose `e` instruction provides a shell-execution primitive. ### Attack Path 1. An attacker supplies a crafted project name, description, or `AUTHOR_NAME` value containing a replacement terminator and embedded newlines. 2. The value is interpolated into a command such as: ```bash sed "s/{DESCRIPTION}/$DESCRIPTION/g" ``` 3. The crafted value terminates the intended substitution and introduces a GNU `sed` `e` instruction. 4. GNU `sed` ...[truncated 847 chars]- Remediation
View remediation