T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/script.sh:43
- Finding
- Arbitrary Command Execution Through AWK Program Injection## Vulnerability Details **File Location**: `scripts/script.sh`, lines 43-45 **Vulnerability Type**: AWK code injection leading to arbitrary command execution **Risk Level**: High ### Vulnerable Code ```bash calc() { awk "BEGIN { printf \"%.6g\", $1 }" } ``` User-controlled conversion values reach this function through calls such as: ```bash calc "${val} * ${from_m} / ${to_m}" ``` ### Technical Analysis The `calc` function interpolates its first argument directly into an AWK program enclosed in a double-quoted shell string. The conversion value is therefore treated as executable AWK source rather than numeric data. The conversion functions quote shell arguments while passing them to `calc`, which prevents ordinary shell word splitting at that stage but does not prevent AWK-language injection. An attacker can terminate the intended arithmetic expression with a semicolon and insert additional AWK statements. Because AWK provides the `system()` function, injected AWK code can invoke arbitrary operating-system commands. The issue affects every conversion command because all conversion functions eventually include the attacker-controlled `val` variable in a string passed to `calc`. ### Attack Path 1. An attacker supplies a crafted value as the numeric argument to any supported conversion command. 2. The selected conversion function embeds that value into an arithmetic expression. 3. `calc` inserts the entire expression directly into AWK source code. 4. The crafted value terminates the intended expression and adds an AWK `system()` call. 5. AWK executes the supplied operating-system command with the privileges of the user running UnitConv. Example proof of concept: ```bash ./scripts/script.sh length \ '0; system("id"); printf "%.6g", 0' \ m m ``` This produces an AWK program containing an injected `system("id")` statement. A real attacker could replace `id` with another command available to ...[truncated 640 chars]
- Remediation
- ## Remediation Suggestions 1. Validate the conversion value against a strict numeric grammar before performing any calculation. Support only the required formats, such as integers, decimal numbers, and optionally scientific notation. ```bash validate_number() { local value="$1" [[ "$value" =~ ^[+-]?([0-9]+([.][0-9]*)?|[.][0-9]+)([eE][+-]?[0-9]+)?$ ]] || { err "Invalid numeric value: $value" exit 1 } } ``` 2. Never concatenate user-controlled values into AWK source. Pass all values as data through `awk -v` and use a fixed AWK program: ```bash calc_ratio() { local value="$1" local from_factor="$2" local to_factor="$3" validate_number "$value" awk -v value="$value" \ -v from_factor="$from_factor" \ -v to_factor="$to_factor" \ 'BEGIN { printf "%.6g", value * from_factor / to_factor }' } ``` 3. Use separate fixed calculation functions for special formulas such as temperature conversion, again passing values through `-v` rather than constructing executable AWK expressions. 4. Reject non-finite or unsupported inputs according to the utility's requirements, and add negative-temperature bounds where physical validity is expected. 5. Add regression tests containing AWK metacharacters and payloads such as semicolons, braces, quotes, and `system()` calls. Tests should verify that these inputs are rejected and never cause a subprocess to run. 6. Run the utility with the minimum required privileges and avoid exposing it through a privileged service until the injection flaw has been corrected.