T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:43- Finding
Arbitrary Command Execution Through AWK Program Injection
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh, lines 43-45
Vulnerability Type: AWK code injection leading to arbitrary command execution
Risk Level: HighVulnerable Code
bash calc() { awk "BEGIN { printf \"%.6g\", $1 }" }User-controlled conversion values reach this function through calls such as:
bash calc "${val} * ${from_m} / ${to_m}"Technical Analysis
The
calcfunction interpolates its first argument directly into an AWK program enclosed in a double-quoted shell string. The conversion value is therefore treated as executable AWK source rather than numeric data.The conversion functions quote shell arguments while passing them to
calc, which prevents ordinary shell word splitting at that stage but does not prevent AWK-language injection. An attacker can terminate the intended arithmetic expression with a semicolon and insert additional AWK statements. Because AWK provides thesystem()function, injected AWK code can invoke arbitrary operating-system commands.The issue affects every conversion command because all conversion functions eventually include the attacker-controlled
valvariable in a string passed tocalc.Attack Path
- An attacker supplies a crafted value as the numeric argument to any supported conversion command.
- The selected conversion function embeds that value into an arithmetic expression.
calcinserts the entire expression directly into AWK source code.- The crafted value terminates the intended expression and adds an AWK
system()call. - AWK executes the supplied operating-system command with the privileges of the user running UnitConv.
Example proof of concept:
bash ./scripts/script.sh length \ '0; system("id"); printf "%.6g", 0' \ m mThis produces an AWK program containing an injected
system("id")statement. A real attacker could replaceidwith another command available to ...[truncated 640 chars]- Remediation
View remediation
Remediation Suggestions
- Validate the conversion value against a strict numeric grammar before performing any calculation. Support only the required formats, such as integers, decimal numbers, and optionally scientific notation.
bash validate_number() { local value="$1" [[ "$value" =~ ^[+-]?([0-9]+([.][0-9]*)?|[.][0-9]+)([eE][+-]?[0-9]+)?$ ]] || { err "Invalid numeric value: $value" exit 1 } }- Never concatenate user-controlled values into AWK source. Pass all values as data through
awk -vand use a fixed AWK program:
bash calc_ratio() { local value="$1" local from_factor="$2" local to_factor="$3" validate_number "$value" awk -v value="$value" \ -v from_factor="$from_factor" \ -v to_factor="$to_factor" \ 'BEGIN { printf "%.6g", value * from_factor / to_factor }' }-
Use separate fixed calculation functions for special formulas such as temperature conversion, again passing values through
-vrather than constructing executable AWK expressions. -
Reject non-finite or unsupported inputs according to the utility's requirements, and add negative-temperature bounds where physical validity is expected.
-
Add regression tests containing AWK metacharacters and payloads such as semicolons, braces, quotes, and
system()calls. Tests should verify that these inputs are rejected and never cause a subprocess to run. -
Run the utility with the minimum required privileges and avoid exposing it through a privileged service until the injection flaw has been corrected.