T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:132- Finding
Arbitrary Command Execution Through Unsafe sed Expression Construction
- Content
View full analysis
/dev/null | cut -d= -f2- || echo "(not set)" else if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" ``` ### Technical Analysis The `key` and `val` command-line arguments are interpolated directly into a GNU `sed` program. Neither value is escaped for use as a regular expression, replacement string, or `sed` command. An attacker can inject the `|` expression delimiter and GNU `sed`'s `e` substitution flag. The `e` flag executes the resulting pattern space through a shell after a successful substitution. A semicolon and comment can be used to terminate the injected expression and neutralize the delimiter appended by the script. For example, after creating an entry named `x`, a value resembling the following can turn the generated substitution into an executable `sed` expression: ```text ;touch /tmp/andon-pwned|e;# ``` The resulting expression is equivalent to: ```sed s|^x=.*|x=;touch /tmp/andon-pwned|e;#| ``` On GNU `sed`, the successful substitution causes `x=;touch /tmp/andon-pwned` to be interpreted by a shell. The unescaped `key` also permits regular-expression manipulation and can cause unintended configuration entries to be matched or replaced. ### Attack Path 1. The attacker can invoke the Skill or influence arguments supplied to its `config` command. 2. The attacker first creates a configuration entry: ```bash scripts/script.sh config x initial ``` 3. The attacker updates that entry with a crafted value containing a `sed` delimiter, the GNU `e` flag, and a comment: ```bash scripts/script.sh config x ';touch /tmp/andon-pwned|e;#' ``` 4. The existing-entry check succee ...[truncated 873 chars]- Remediation
View remediation
&2 exit 1 } ``` - Rewrite the configuration file using logic that compares keys literally rather than interpreting them as regular expressions. - Prefer a structured configuration format and serializer, such as JSON generated with `jq`. - If `sed` must be retained, separately escape all regular-expression metacharacters in the key and all replacement metacharacters, delimiters, backslashes, and newlines in the value. Do not rely on shell quoting alone. - Write updates to a securely created temporary file and atomically replace the original configuration file after successful validation. - Add regression tests containing `|`, `;`, `#`, `&`, backslashes, newlines, and GNU `sed` flags. ]]>