4 ms·
Unquoted variables are an attack vector. Plain and simple. The IFS tip, as described in the original article, does nothing to remedy it. https://www.owasp.org/
by staticshock 12y ago
Unquoted variables are an attack vector. Plain and simple. The IFS tip, as described in the original article, does nothing to remedy it.
https://www.owasp.org/index.php/Command_Injection https://www.owasp.org/index.php/Command_Injection
- redsymbol 12y agoCan you give an example of an exploit in bash? The link you give is excellent information, but doesn't have any shell script examples. My first thought: It seems like only $@, $* and variables read from the environment could be possible attack vectors. But since shell scripts can't be setuid, it's hard for me to immediately imagine how unquoting could enable a new exploit. EDIT: the most dangerous example I can think of right now is a script like this, where a webapp invokes the script and passes a GET param as an argument: #!/bin/bash exec $1 But if I execute this like so: ./badscript.sh 'some-benign-command ; cat /etc/passwd' ... then passwd is not exposed, because the tokens ";", "cat" and "/etc/passwd" are passed into the argv of some-benign-command. (And if "cat /etc/password" itself can be passed as $1, then quoting won't help...)