CODEWITHSUNDEEP
bashsecurity
Brad
Brad

Reputation: 3510

Is it possible to perform shell injection through a read and/or to break out of quotes?

Consider this example of (attempted) shell injection:

test1.sh:

#!/bin/sh
read FOO
echo ${FOO}

z.dat:

foo && sleep 1 && echo 'exploited'

Then run:

cat z.dat | ./test.sh

On my machine (Ubuntu w/bash) the payload is always (correctly) treated as a single string and never executes the malicious sleep and echo commands.

Question 1: Is it possible to modify z.dat so that test.sh is vulnerable to injection? In particular are there specific shells that might be vulnerable?

Question 2: If so, is changing the test script to quote the variable (shown below) an absolute defense?

test2.sh:

#!/bin/sh
read FOO
echo "${FOO}"

Thanks!

Upvotes: 3

Views: 6031

Answers (1)

Marc Young
Marc Young

Reputation: 4012

Not according to: https://developer.apple.com/library/mac/documentation/OpenSource/Conceptual/ShellScripting/ShellScriptSecurity/ShellScriptSecurity.html

Search for 'Backwards Compatibility Example'

Upvotes: 2

Related Questions