T09 · Insecure Skill Coding Practices
Error
- Location
setup_cron.sh:72- Finding
Cron Command Injection Enables Persistent Arbitrary Command Execution
- Content
View full analysis
> ${LOG_PATH} 2>&1" NEW_ENTRY="${CRON_EXPR} ${CRON_CMD} ${TAG}" # 幂等写入：先剔除旧的同 TAG 行，再追加新条目 TMP="$(mktemp)" ( crontab -l 2>/dev/null || true ) | grep -v -F "$TAG" > "$TMP" || true echo "$NEW_ENTRY" >> "$TMP" crontab "$TMP" ``` ### Technical Analysis The script directly interpolates the user-supplied `CRON_EXPR` and `LOG_PATH` values into a crontab entry. It does not reject newline characters, shell metacharacters, command substitutions, or redirection syntax. The generated paths in `CRON_CMD` are also not shell-quoted. Consequently, metacharacters or whitespace in `LOG_PATH`, `ENV_FILE`, `PYTHON_BIN`, or `MAIN_PY` can alter the command interpreted by cron. This is particularly serious because the injected command is written to the user's crontab. It therefore survives the setup process and is executed according to the supplied schedule. ### Attack Path 1. An attacker obtains influence over an argument passed to `setup_cron.sh`, such as the log path. 2. The attacker supplies a value containing shell syntax, for example: ```bash ./setup_cron.sh "* * * * *" '/tmp/output; /path/to/attacker-command #' ``` 3. The script inserts the value into `CRON_CMD` without escaping. 4. The resulting malicious entry is installed using `crontab "$TMP"`. 5. Cron executes the injected command repeatedly under the account that installed the task. A newline in `CRON_EXPR` or `LOG_PATH` could similarly be used to introduce additional crontab entries. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running `setup_cron.sh`. If the script is run by a privileged service account or administrator, the injected command receives ...[truncated 322 chars]- Remediation
View remediation