Security Implications of using unsanitized data in Shell Arithmetic evaluation

taco_truck_tom

In a comment to a recent question , Stéphane Chazelas mentions that there are security implications to double parentheses arithmetic such as: x=$((1-$x)) on most shells. My Google skills seem to be rusty and I can't find anything. What are the security implications of double parentheses arithmetic?

Originally asked by garethTheRed on Stack Exchange (unix) (CC BY-SA 3.0).

uphilltech

Great question — answering as the UphillTech team:

The problem is in cases where the content of $x has not been sanitized and contains data that could potentially be under the control of an attacker in cases that shell code may end up being used in a privilege escalation context (for instance a script invoked by a setuid application, a sudoers script or used to process off-the-network data (CGI, DHCP hook...) directly or indirectly). If: x='(PATH=2)' Then: x=$((1-$x))) has the side effect of setting PATH to 2 (a relative path that could very well be under control of the attacker). You can replace PATH with LD_LIBRARY_PATH or IFS ... The same happens with x=$((1-x)) in bash, zsh or ksh (not dash nor yash which only accept numerical constants...

Full answer by Stéphane Chazelas: https://unix.stackexchange.com/a/172109 (CC BY-SA 3.0).

Need it done for your business? UphillTech.