T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/create_agent.sh:222
- Finding
- Command Injection Through Unsafe GNU sed Replacement<![CDATA[ ## Vulnerability Details **File Location**: `scripts/create_agent.sh`, lines 222-225 **Vulnerability Type**: Shell command injection through dynamically constructed GNU sed programs **Risk Level**: High ### Vulnerable Code ```bash # Yer tutucuları değiştir sed -i "s/{AGENT_ID}/${AGENT_ID}/g" "$WORKSPACE_DIR/cron/README.md" sed -i "s/{AGENT_NAME}/${AGENT_NAME}/g" "$WORKSPACE_DIR/cron/README.md" sed -i "s/{AGENT_ID}/${AGENT_ID}/g" "$WORKSPACE_DIR/cron/ornek.py" sed -i "s/{AGENT_NAME}/${AGENT_NAME}/g" "$WORKSPACE_DIR/cron/ornek.py" ``` ### Technical Analysis `AGENT_NAME` is obtained from the `--name` command-line argument and is not validated or escaped before being embedded directly into a double-quoted sed expression. Characters significant to sed—including `/`, `\`, `&`, semicolons, and newline characters—can therefore alter the generated sed program rather than being treated strictly as replacement text. On GNU sed, an attacker who can supply a crafted multiline agent name can terminate the intended substitution and introduce an `e` command. The `e` command executes the resulting text through a shell. Quoting the entire sed expression with shell double quotes does not prevent this because the injection occurs inside sed's command language after shell expansion. The same issue occurs twice for `AGENT_NAME`. `AGENT_ID` is constrained to a smaller character set before these statements, so the directly exploitable input identified here is the unvalidated agent name. ### Attack Path 1. An attacker obtains the ability to invoke `create_agent.sh` or influence the value passed to `--name`. 2. The attacker supplies an agent name containing sed syntax and newline characters crafted to terminate the intended substitution. 3. The shell expands `${AGENT_NAME}` into the sed program. 4. GNU sed parses the injected content as commands rather than literal replacement data. 5. An injected sed `e` command invokes `/bin/sh`. 6. The attacker's command executes wi ...[truncated 575 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not construct sed programs using untrusted data. - Generate the template files directly using a language or API that handles replacements as data rather than executable syntax. - If sed must be retained, rigorously escape replacement metacharacters such as `\`, `&`, and the selected delimiter, and reject newline and control characters. - Apply a conservative allowlist and length limit to agent names. - Prefer a structured template implementation, for example Python string replacement with values passed through environment variables or command-line arguments. - Add regression tests containing slashes, ampersands, backslashes, newlines, and sed command characters. ]]>