Is this script vulnerable to command injection?
up vote
0
down vote
favorite
I have the following script that I can run as root in a server with sudo:
#!/bin/bash
export filename=`echo $1`
grep -i "word" $filename
I suspect that this script is vulnerable to command injection, is this the case?
However, when I put something as "test ;id" as an argument of the script with sudo (e.g. sudo myScript.sh test; id). The "id" command is running but with my user access right not as root.
bash security code-injection
asked Nov 8 at 10:40
user1528760
82211
add a comment |
up vote
0
down vote
favorite
I have the following script that I can run as root in a server with sudo:
#!/bin/bash
export filename=`echo $1`
grep -i "word" $filename
I suspect that this script is vulnerable to command injection, is this the case?
However, when I put something as "test ;id" as an argument of the script with sudo (e.g. sudo myScript.sh test; id). The "id" command is running but with my user access right not as root.
bash security code-injection
asked Nov 8 at 10:40
user1528760
82211
Double quote the$filenamein the last line.
– choroba
Nov 8 at 10:51
Try using'-r /'as the argument.
– choroba
Nov 8 at 10:55
Theecho $1is the vulnerable point for me. As it stands that is pointless, so I assume it is something more complex in reality. Put quotes round the"$1"as suggested.
– Gem Taylor
Nov 8 at 11:28
Use Shellcheck to find many code problems, including command injection vulnerabilities. It finds several problems with the example code. One problem that it does not find is the inability to handle filenames that begin with '-'. A fully safe 'grep command isgrep -i -- word "filename". See Bash Pitfalls #3 (Filenames with leading dashes).
– pjh
Nov 8 at 20:00
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I have the following script that I can run as root in a server with sudo:
#!/bin/bash
export filename=`echo $1`
grep -i "word" $filename
I suspect that this script is vulnerable to command injection, is this the case?
However, when I put something as "test ;id" as an argument of the script with sudo (e.g. sudo myScript.sh test; id). The "id" command is running but with my user access right not as root.
bash security code-injection
asked Nov 8 at 10:40
user1528760
82211
I have the following script that I can run as root in a server with sudo:
#!/bin/bash
export filename=`echo $1`
grep -i "word" $filename
I suspect that this script is vulnerable to command injection, is this the case?
However, when I put something as "test ;id" as an argument of the script with sudo (e.g. sudo myScript.sh test; id). The "id" command is running but with my user access right not as root.
bash security code-injection
bash security code-injection
asked Nov 8 at 10:40
user1528760
82211
asked Nov 8 at 10:40
user1528760
82211
asked Nov 8 at 10:40
user1528760
82211
asked Nov 8 at 10:40
user1528760
82211
asked Nov 8 at 10:40
user1528760
82211
82211
Double quote the$filenamein the last line.
– choroba
Nov 8 at 10:51
Try using'-r /'as the argument.
– choroba
Nov 8 at 10:55
Theecho $1is the vulnerable point for me. As it stands that is pointless, so I assume it is something more complex in reality. Put quotes round the"$1"as suggested.
– Gem Taylor
Nov 8 at 11:28
Use Shellcheck to find many code problems, including command injection vulnerabilities. It finds several problems with the example code. One problem that it does not find is the inability to handle filenames that begin with '-'. A fully safe 'grep command isgrep -i -- word "filename". See Bash Pitfalls #3 (Filenames with leading dashes).
– pjh
Nov 8 at 20:00
add a comment |
Double quote the$filenamein the last line.
– choroba
Nov 8 at 10:51
Try using'-r /'as the argument.
– choroba
Nov 8 at 10:55
Theecho $1is the vulnerable point for me. As it stands that is pointless, so I assume it is something more complex in reality. Put quotes round the"$1"as suggested.
– Gem Taylor
Nov 8 at 11:28
Use Shellcheck to find many code problems, including command injection vulnerabilities. It finds several problems with the example code. One problem that it does not find is the inability to handle filenames that begin with '-'. A fully safe 'grep command isgrep -i -- word "filename". See Bash Pitfalls #3 (Filenames with leading dashes).
– pjh
Nov 8 at 20:00
Double quote the
$filename in the last line.– choroba
Nov 8 at 10:51
Double quote the
$filename in the last line.– choroba
Nov 8 at 10:51
Try using
'-r /' as the argument.– choroba
Nov 8 at 10:55
Try using
'-r /' as the argument.– choroba
Nov 8 at 10:55
The
echo $1 is the vulnerable point for me. As it stands that is pointless, so I assume it is something more complex in reality. Put quotes round the "$1" as suggested.– Gem Taylor
Nov 8 at 11:28
The
echo $1 is the vulnerable point for me. As it stands that is pointless, so I assume it is something more complex in reality. Put quotes round the "$1" as suggested.– Gem Taylor
Nov 8 at 11:28
Use Shellcheck to find many code problems, including command injection vulnerabilities. It finds several problems with the example code. One problem that it does not find is the inability to handle filenames that begin with '-'. A fully safe 'grep command is
grep -i -- word "filename". See Bash Pitfalls #3 (Filenames with leading dashes).– pjh
Nov 8 at 20:00
Use Shellcheck to find many code problems, including command injection vulnerabilities. It finds several problems with the example code. One problem that it does not find is the inability to handle filenames that begin with '-'. A fully safe 'grep command is
grep -i -- word "filename". See Bash Pitfalls #3 (Filenames with leading dashes).– pjh
Nov 8 at 20:00
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
draft saved
draft discarded
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53206016%2fis-this-script-vulnerable-to-command-injection%23new-answer', 'question_page');
}
);
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Double quote the
$filenamein the last line.– choroba
Nov 8 at 10:51
Try using
'-r /'as the argument.– choroba
Nov 8 at 10:55
The
echo $1is the vulnerable point for me. As it stands that is pointless, so I assume it is something more complex in reality. Put quotes round the"$1"as suggested.– Gem Taylor
Nov 8 at 11:28
Use Shellcheck to find many code problems, including command injection vulnerabilities. It finds several problems with the example code. One problem that it does not find is the inability to handle filenames that begin with '-'. A fully safe 'grep command is
grep -i -- word "filename". See Bash Pitfalls #3 (Filenames with leading dashes).– pjh
Nov 8 at 20:00