T09 · Insecure Skill Coding Practices
Error
- Location
- serverless-template-generator.sh:83
- Finding
- Arbitrary Command Execution Through GNU sed Expression Injection<![CDATA[ ## Vulnerability Details **File Location**: `serverless-template-generator.sh:4, 64-84` **Vulnerability Type**: OS command injection through an attacker-controlled GNU sed expression **Risk Level**: High ### Vulnerable Code ```bash NAME="${1:-my-function}" ``` ```bash cloudflare) mkdir -p "$PLATFORM"/src cat > "$PLATFORM/src/index.js" << 'JS' export default { async fetch(request, env, ctx) { return new Response(JSON.stringify({ message: 'Hello from Cloudflare Workers!', platform: 'cloudflare' }), { headers: { 'content-type': 'application/json' } }); } }; JS cat > "$PLATFORM/wrangler.toml" << 'TOML' name = "WORKER_NAME" main = "src/index.js" compatibility_date = "2023-01-01" TOML sed -i "s/WORKER_NAME/$NAME/g" "$PLATFORM/wrangler.toml" ;; ``` ### Technical Analysis The first positional argument is assigned to `NAME` without validation and is inserted directly into a GNU sed substitution program: ```bash sed -i "s/WORKER_NAME/$NAME/g" "$PLATFORM/wrangler.toml" ``` Shell quoting prevents direct shell metacharacters in `NAME` from being interpreted by the invoking shell, but it does not make the resulting sed program safe. An attacker can inject the `/` delimiter, sed flags, additional commands, and comments. GNU sed supports the `e` substitution flag, which executes the substituted pattern-space contents as a shell command. For example, a name shaped like: ```text touch PWNED/e;# ``` produces a sed program equivalent to: ```sed s/WORKER_NAME/touch PWNED/e;#/g ``` The substitution produces `touch PWNED`, and the injected `e` flag asks GNU sed to execute it. The comment suppresses the remaining intended expression. More consequential commands can be supplied subject to sed delimiter handling. This vulnerability is reachable whenever the generator is invoked with the `cloudflare` platform and the attacker can control the project name. ### Attack Path 1. An attacker supplies a crafted fir ...[truncated 1636 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Enforce a strict allowlist for project names before using them: ```bash if [[ ! "$NAME" =~ ^[A-Za-z0-9][A-Za-z0-9_-]*$ ]]; then printf 'Error: invalid project name\n' >&2 exit 1 fi ``` 2. Avoid constructing a sed program from untrusted input. Use a mechanism that treats the replacement as data, such as passing the value to a small JSON/TOML-aware generator. 3. If sed must be retained, escape every character significant in a sed replacement, including the delimiter, backslash, and ampersand. Strict name validation should still be applied as defense in depth. 4. Generate the complete TOML file using a quoted template plus a validated value rather than creating a placeholder and subsequently replacing it. 5. Add regression tests using names containing `/`, `\`, `&`, semicolons, newlines, sed flags, and shell-command text. The script must reject all such names. 6. Run template generation with least privilege, especially in CI/CD environments, and do not expose generator arguments directly to untrusted users. ]]>