T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:141- Finding
GNU sed Program Injection Through Configuration Values
- Content
View full analysis
/dev/null; then sed -i "s|^${key}=.*|${key}=${val}|" "$cfg" else echo "${key}=${val}" >> "$cfg" fi ``` ### Technical Analysis The user-controlled `key` and `val` arguments are interpolated directly into a GNU `sed` program. Shell quoting protects the arguments from immediate shell word splitting and expansion, but it does not make them safe as `sed` syntax. An attacker can include delimiter characters, newlines, regular-expression metacharacters, replacement metacharacters, or GNU `sed` commands in these arguments. In environments using GNU `sed`, injection of the `e` substitution flag can cause the resulting replacement text to be passed to a shell for execution. The preceding `grep` operation is also built from the unescaped key: ```bash grep -q "^${key}=" "$cfg" ``` Consequently, the key is treated as a regular expression rather than a literal configuration key. This can cause an attacker-controlled key to match an unintended existing record and reach the vulnerable update branch. ### Attack Path A representative exploitation sequence is: 1. The attacker gains control over arguments passed to `scripts/script.sh config`, such as through an application wrapper, automation service, or agent action that accepts untrusted configuration values. 2. The attacker creates a normal configuration record so that the configuration file and target key exist: ```bash scripts/script.sh config target initial ``` 3. The attacker invokes the update operation with a value containing `sed` delimiters, an `e` flag, and a newline that comments out or otherwise neutralizes the script's generated trailing delimiter. A payload can make the generated replacement resemble: ```sed s|^ ...[truncated 1139 chars]- Remediation
View remediation
&2 return 1 fi ``` 3. Reject carriage returns, newlines, NUL-equivalent input, and other control characters in values. 4. Replace the dynamic `sed` expression with a safe configuration writer that performs literal key comparisons. For example, use a temporary file and an `awk -v` variable, while ensuring output values cannot create extra records. 5. Create temporary files using `mktemp` inside a trusted directory, set restrictive permissions, and atomically rename the completed file. 6. If arbitrary values must be supported, use a structured format such as JSON and manipulate it with a proper serializer rather than regular-expression substitutions. 7. Add regression tests covering values containing `|`, `&`, backslashes, newlines, regular-expression syntax, and strings resembling `sed` flags or commands. ]]>