T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:75- Finding
AWK Source Injection Enables Arbitrary Command Execution
- Content
View full analysis
" awk "BEGIN{base=5; per_kg=2.5; printf \"Shipping %skg %s->%s: \$%.2f\n\",$2,$3,$4,base+$2*per_kg}" } cmd_compare() { local weight="${2:-}" local from="${3:-}" local to="${4:-}" [ -z "$weight" ] && die "Usage: $SCRIPT_NAME compare " echo 'Standard: '; cmd_rate $2 $3 $4; echo 'Express (2x): '; awk "BEGIN{printf \"\$%.2f\n\",(5+$2*2.5)*2}" } cmd_estimate() { local length="${2:-}" local width="${3:-}" local height="${4:-}" local weight="${5:-}" [ -z "$length" ] && die "Usage: $SCRIPT_NAME estimate " awk "BEGIN{vol=$2*$3*$4/5000; actual=$5; dim=vol>actual?vol:actual; printf \"Billable weight: %.1fkg\n\",dim}" } cmd_duty() { local value="${2:-}" local country="${3:-}" [ -z "$value" ] && die "Usage: $SCRIPT_NAME duty " awk "BEGIN{rate=0.1; printf \"Duty estimate for \$%s to %s: \$%.2f\n\",$2,$3,$2*rate}" } ``` ### Technical Analysis The command-line arguments are expanded directly into double-quoted AWK program strings. They are therefore interpreted as AWK source code rather than treated exclusively as data. An attacker who controls one of the affected arguments can insert AWK syntax that terminates the intended expression and introduces additional statements. AWK provides the `system()` function, allowing injected AWK code to execute operating-system commands. Although the functions assign arguments to local variables, those variables are not used safely. Direct references such as `$2`, `$3`, and `$4` are concatenated into executable AWK source. The issue affects the `rate`, ...[truncated 1486 chars]- Remediation
View remediation
%s: $%.2f\n", weight, from, to, base + weight * per_kg }' ``` 3. Validate numeric fields before invoking AWK. For example, reject empty, negative, non-finite, and non-numeric weights, dimensions, and declared values. 4. Validate the exact argument count for each command before accessing any argument. 5. Quote all shell expansions, including arguments passed between functions. 6. Use the already defined local variables instead of positional parameters inside AWK construction. 7. Add regression tests using AWK metacharacters, quotes, semicolons, braces, newlines, and `system()` payloads to confirm that all supplied values remain data. ]]>