T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:138- Finding
Arbitrary Command Execution Through sed Injection in Configuration Updates
- Content
View full analysis
)"; fi elif [ -z "$val" ]; then grep "^${key}=" "$cfg" 2>/dev/null | cut -d= -f2- || echo "(not set)" else if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi echo "Set: $key=$val" fi } ``` ### Technical Analysis Both `key` and `val` are inserted directly into a GNU `sed` program without escaping. An attacker can include the `|` delimiter and additional `sed` syntax in either argument. In particular, GNU `sed` supports the `e` substitution flag, which executes the replacement text through a shell. The vulnerable branch is reached when the configuration file already contains a record matching the supplied key. A crafted value can terminate the intended replacement, add the `e` flag, and arrange for the generated replacement text to contain shell metacharacters and attacker-selected commands. The use of shell quoting around the entire `sed` expression does not prevent this attack because the injected content is interpreted by `sed` after shell expansion. ### Attack Path 1. An attacker first creates or identifies an existing configuration key using `script.sh config `. 2. The attacker invokes the configuration command again for the same key with a value containing a `sed` delimiter, shell me ...[truncated 905 chars]- Remediation
View remediation