T09 · Insecure Skill Coding Practices
Error
- Location
scripts/backup-versioned.sh:24- Finding
Arbitrary Command Execution Through an Untrusted Version Source
- Content
View full analysis
/dev/null || echo "unknown") elif command -v "$VERSION_SOURCE" &> /dev/null; then # Version from command CURRENT_VERSION=$($VERSION_SOURCE 2>/dev/null || echo "unknown") else # Try as command string CURRENT_VERSION=$(eval "$VERSION_SOURCE" 2>/dev/null || echo "unknown") fi ``` ### Technical Analysis `VERSION_SOURCE` is supplied directly by the caller. If it is not recognized as a regular file or executable name, the script passes it to `eval`. The shell consequently reparses the entire value as shell syntax. An attacker who can influence this argument can include command separators, command substitutions, pipelines, redirections, or other shell constructs. These constructs execute with the privileges of the user running the script. The preceding command-execution branch is also unsafe because it expands a string as a command rather than handling a validated executable and arguments as a structured array. Although the documentation intentionally supports obtaining a version from command output, supporting this feature does not require `eval`. The implementation unnecessarily converts a data parameter into unrestricted shell code. ### Attack Path 1. A user, automation system, or wrapper invokes `backup-versioned.sh` with an attacker-controlled version-source argument. 2. The supplied value does not identify a regular file and is not accepted by `command -v`. 3. Execution reaches `eval "$VERSION_SOURCE"`. 4. The shell interprets embedded shell syntax instead of treating the value as data. 5. The injected commands execute under the account that launched the backup script. 6. If the vulnerable invocation is placed in cro ...[truncated 657 chars]- Remediation
View remediation
/dev/null) || { echo "Error: version command failed" >&2 exit 1 } ``` 6. Do not silently convert command failures to the string `unknown`, because this can cause misleading version transitions and unintended backups. 7. Document that command-based version sources must come only from trusted configuration. 8. Run scheduled backups under a dedicated, minimally privileged account with read access only to required source data and write access only to the intended backup directory. ]]>