T09 · Insecure Skill Coding Practices
- Location
scripts/generate_report.sh:192- Finding
Command Injection Through User-Controlled GNU sed Program
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate_report.sh:192
Vulnerability Type: Command injection through unsafe construction of a sed program
Risk Level: Criticalbash # Replace placeholders sed -i "s/\[COMPANY_NAME\]/$COMPANY_NAME/g" "$REPORT_FILE"Technical Analysis
COMPANY_NAMEoriginates from the first command-line argument and is inserted directly into a double-quoted GNU sed program. Shell quoting prevents a direct shell metacharacter injection at the initial expansion stage, but it does not make the resulting sed program safe.An attacker can include sed delimiters, backslashes, ampersands, or literal newline characters in the company name. A newline can terminate the intended substitution and introduce additional sed commands. On GNU sed, the
ecommand can execute a shell command. Consequently, crafted input can transform the generated sed expression into multiple sed instructions, one of which invokes a command.The value is also not escaped for replacement-string semantics. Even inputs that do not achieve command execution can corrupt the generated report or cause report generation to fail.
Attack Path
- The attacker supplies a crafted company name directly to
generate_report.shor places it in a company list processed bybatch_query.sh. - The value is forwarded unchanged as
COMPANY_NAME. generate_report.shinterpolates the value into the sed program at line 192.- Embedded delimiter or newline content terminates the intended substitution expression.
- On GNU sed, an injected
einstruction executes an attacker-selected shell command. - The command runs with the user identity, filesystem access, environment variables, and network permissions of the Skill process.
Impact Assessment
Successful exploitation provides arbitrary command execution under the account running the Skill. The attacker could read or modify files available to that accou ...[truncated 384 chars]
- The attacker supplies a crafted company name directly to
- Remediation
View remediation
Remediation Suggestions
- Do not interpolate untrusted data into a sed program.
- Use a template renderer that accepts values as data rather than executable syntax.
- A safe alternative is to perform replacement in a small Python program where the company name is passed as a normal argument or environment value.
- If sed must be retained, reject carriage returns, newlines, and other control characters, and correctly escape backslashes, the selected delimiter, and ampersands before constructing the replacement.
- Validate company names against a conservative length and character policy.
- Run report generation with a minimal environment and without unnecessary credentials.
- Add regression tests for names containing
/,&, backslashes, newlines, sed syntax, shell syntax, and Unicode control characters.