Starting a process with a shell detected BAN-B605
Starting a process with a shell, possible injection detected, security issue.
29 f'venv\\Scripts\\activate && python userbot\\helpers\\skyrim.py "{text}" {level}'
30 )
31 else:
32 os.system(33 f'. venv/bin/activate && python userbot//helpers//skyrim.py "{text}" {level}'34 )35 except Exception:
36 await message.edit("```Failed to generate skill```")
37 time.sleep(2)Starting a process with a shell, possible injection detected, security issue.
25 try:
26 try:
27 if os.name == "nt":
28 os.system(29 f'venv\\Scripts\\activate && python userbot\\helpers\\skyrim.py "{text}" {level}'30 )31 else:
32 os.system(
33 f'. venv/bin/activate && python userbot//helpers//skyrim.py "{text}" {level}'Starting a process with a shell, possible injection detected, security issue.
25
26 await message.edit_text("Carbonizing code...")
27 # Do the thing
28 os.system("carbon-now -h -t userbot/downloads/carbon {}".format(file))29 # await message.edit_text("Carbonizing completed...")
30 # Send the thing
31 await bot.send_photo(message.chat.id, "userbot/downloads/carbon.png")
Description
Spawning of a subprocess using a command shell is dangerous as it is vulnerable to various shell injection attacks. Great care should be taken to sanitize all input in order to mitigate this risk. Calls of this type are identified by the use of certain commands which are known to use shells.
It is possible for an attacker to craft inputs to issue different commands than the ones you intended such as removing a file.
It is recommended to use functions that don't spawn a shell. If you must use them, use shlex.quote to sanitize the input by changing it to the shell-escaped version.
Bad practice
import os
# Malicious input
filename = "file.py; echo foo"
# Executing command in a shell without escaping. This will also run `echo foo`.
os.system("git add " + filename)
Recommended
import os, shlex
# Malicious input
filename = "file.py; echo foo"
# This ensures someone can't inject other commands into the given command.
os.system("git add " + shlex.quote(filename))
References:
- Command Injection
- shlex
- OWASP Top 10 2021 Category A03 - Injection
- SANS Top 25
- CWE-78