T09 · Insecure Skill Coding Practices
Error
- Location
references/windows-cmd.md:76- Finding
Command Injection Through Unvalidated Shortcut Keys in Windows CMD Template
- Content
View full analysis
nul') do set "TARGET=%%B" if not defined TARGET ( echo Unknown shortcut: %KEY% echo Tip: jump list exit /b 1 ) ``` The same unvalidated value is also inserted into commands used to add and remove shortcuts: ```bat :add set "KEY=%~2" if "%KEY%"=="" ( echo Usage: jump add ^ ^ exit /b 1 ) shift /1 shift /1 set "PATHVAL=%*" if "%PATHVAL%"=="" ( echo Usage: jump add ^ ^ exit /b 1 ) if not exist "%PATHVAL%" ( echo Invalid path: %PATHVAL% exit /b 1 ) set "TMP=%DB%.tmp" findstr /v /b /c:"%KEY%|" "%DB%" > "%TMP%" 2>nul echo %KEY%^|%PATHVAL%>> "%TMP%" ``` ```bat :rm set "KEY=%~2" if "%KEY%"=="" ( echo Usage: jump remove ^ exit /b 1 ) set "TMP=%DB%.tmp" findstr /v /b /c:"%KEY%|" "%DB%" > "%TMP%" 2>nul move /y "%TMP%" "%DB%" >nul echo Removed: %KEY% ``` ### Technical Analysis The shortcut key originates directly from `%~1` or `%~2` and is not restricted to a safe character set. It is subsequently expanded into executable CMD syntax. Quoting `%KEY%` inside `/c:"%KEY%|"` does not provide a reliable security boundary in Windows CMD. A malicious key containing a quotation mark and CMD metacharacters such as `&`, `|`, `<`, `>`, `^`, `%`, or `!` can alter the structure of the command after variable expansion. The lookup operation is particularly sensitive because the command between `('...')` in `for /f` is executed by a nested command processor. The add and remove branches also expand the key directly into `findstr` and `echo` command lines. Consequently, command separators or redirection operators embedded in the ...[truncated 2008 chars]- Remediation
View remediation
`, `^`, `(`, or `)`. 3. **Avoid nested command execution.** Do not pass attacker-influenced data into the command string used by `for /f ('...')`. Parse the database as data with `for /f "usebackq tokens=1* delims=|" %%A in ("%DB%")` and compare parsed keys rather than constructing a `findstr` command from the requested key. 4. **Avoid expanding untrusted values as command syntax.** Do not use constructs such as: ```bat echo %KEY%^|%PATHVAL% ``` Write validated values only, and ensure paths and keys cannot contain control characters or CMD metacharacters. 5. **Handle delayed expansion carefully.** The script enables delayed expansion globally. Either disable it while processing user-controlled values or reject `!`, because delayed expansion can transform data during execution. 6. **Harden database updates.** Use a uniquely named temporary file in a user-controlled, access-restricted directory. Verify command success before replacing the original database, and clean up temporary files on failure. 7. **Add negative security tests.** Test lookup, add, and remove operations with every CMD metacharacter, embedded quotes, percent expansion syntax, exclamation marks, whitespace, and control characters. Confirm that malformed keys are rejected before any file or command operation occurs. ]]>