🛡️ Sentinel: Fix command injection vulnerability via BASH env var in popen()#1764
🛡️ Sentinel: Fix command injection vulnerability via BASH env var in popen()#1764emkey1 wants to merge 1 commit into
Conversation
…en()
In `src/backend_ast/shell/shell_builtins.inc`, `shellSafeGetenv("BASH")` was used to resolve the path to bash for a `popen()` call used to probe arithmetic error string formats. Because this path is read from an environment variable and directly executed without proper sanitization, an attacker could control `BASH` to point to a malicious binary or injected shell string to execute arbitrary commands.
This patch mitigates the issue by explicitly checking the resolved path to ensure it points to `bash` or `sh`. If not, it safely falls back to `/bin/bash` to prevent command execution. It also logs a Sentinel CRITICAL journal entry documenting this vulnerability to prevent future regressions.
Co-authored-by: emkey1 <18100932+emkey1@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🛡️ Sentinel: [CRITICAL] Fix command injection vulnerability via BASH env var
🚨 Severity: CRITICAL
💡 Vulnerability: In
src/backend_ast/shell/shell_builtins.inc,popen()was used to execute a shell command to detect arithmetic error string formats. The path to the shell binary was retrieved from theBASHenvironment variable (shellSafeGetenv("BASH")). This allowed an attacker to execute arbitrary commands by simply settingBASHto a malicious binary or script.🎯 Impact: Local command execution / privilege escalation if an attacker can manipulate environment variables before execution.
🔧 Fix: Added validation to the
BASHpath to ensure it contains eitherbashorsh. If it points to an arbitrary location (e.g., an injected attacker payload), the path is safely reset to the default/bin/bashto prevent execution. Documented the learning in.jules/sentinel.mdto establish a defense-in-depth precedent againstpopen()environment injection.✅ Verification: Tests run locally (via
./Tests/run_pascal_tests.sh) ensure no regression in shell behavior. The CRITICAL learning is securely documented.PR created automatically by Jules for task 18318073711115854798 started by @emkey1