T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/setup.sh:5- Finding
Unvalidated Arguments Permit Privileged Nginx Configuration Injection and Arbitrary Directory Ownership Changes
- Content
View full analysis
/dev/null << NGINX server { listen $PORT; server_name _; root $SERVE_DIR; index index.html; location / { try_files \$uri \$uri/ \$uri/index.html =404; } # Cache static assets location ~* \.(css|js|png|jpg|gif|svg|ico|woff2?)$ { expires 1h; add_header Cache-Control "public, immutable"; } } NGINX ``` ### Technical Analysis The script accepts `PORT` and `SERVE_DIR` directly from positional command-line arguments without validating their format or constraining their values. Both values are interpolated into an Nginx configuration that is written to `/etc/nginx` through `sudo`. Shell quoting does not protect the generated Nginx configuration: embedded newline characters or Nginx syntax remain intact when the values are expanded inside the heredoc. A crafted value can therefore introduce additional Nginx directives or alter the intended configuration structure. The directory argument is also passed to privileged `mkdir` and `chown` operations. It is not canonicalized or restricted to an approved serving root. If an existing sensitive directory is supplied, the script attempts to transfer its ownership to the invoking user. Although the `chown` operation is not recursive, changing the ownership of a sensitive directory can allow subsequent unauthorized modifications to files, configuration, or directory entries. ### Attack Path 1. An attacker or ...[truncated 1283 chars]- Remediation
View remediation