T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:137- Finding
Command Execution Through Sed Program Injection
- Content
View full analysis
)"; fi elif [ -z "$val" ]; then grep "^${key}=" "$cfg" 2>/dev/null | cut -d= -f2- || echo "(not set)" else if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi echo "Set: $key=$val" fi } ``` ### Technical Analysis The user-controlled `key` and `val` arguments are interpolated directly into a sed program. Neither value is escaped for use as a regular expression, replacement string, or sed command. An attacker can supply delimiters, backslashes, regular-expression operators, or embedded newline characters. On GNU sed, a newline can terminate the intended substitution and introduce another sed instruction. The GNU-specific `e` instruction can execute an operating-system command. For example, after a configuration key exists, a multiline value shaped like the following can transform the generated sed program: ```text x| e touch /tmp/contactor-pwned # ``` The resulting program contains an independent `e touch /tmp/contactor-pwned` instruction. GNU sed executes that command while processing the configuration file. The configuration lookup at line 145 is also regex-based and uses the unescaped key, allowing metacharacters in the key to select unintended records. ### Attack Path 1. The attacker invokes the Skill with arguments or otherwise influences parameters passed to `config`. 2. The attacker creates an ordinary ...[truncated 1193 chars]- Remediation
View remediation
&2 return 1 } ``` 2. Reject newline and carriage-return characters in configuration values unless multiline values are explicitly supported. 3. Replace the sed update with exact string processing that does not evaluate input as code or regular expressions. 4. Write updates to a securely created temporary file in the same directory, then atomically rename it over the original file. 5. Apply restrictive permissions to the configuration directory and file. 6. If structured or arbitrary values are required, use a standard JSON parser and serializer rather than a custom `key=value` format. ]]>