🛡️ Sentinel: [CRITICAL] Fix command injection via sed in web console config

.jules/sentinel.md

@@ -78,3 +78,8 @@
 **Vulnerability:** Shell command injection vulnerability identified when passing user-controlled or configured data directly into string-interpolated shell commands (e.g. `f'-u postgres psql -c "CREATE DATABASE {db} OWNER {config.db_user};"'`). Even when nested in double quotes within the python f-string, double-quotes in the substituted parameter break out of the shell quotes.
 **Learning:** Whenever parameters (such as configuration variables, database names, users) are injected into a string that will be evaluated by a shell (like `sudo -S {cmd}` or `-c "{query}"`), they must be properly escaped to ensure the shell treats them as a single literal argument.
 **Prevention:** Always use `shlex.quote()` on the full query string before interpolating it into the shell command string (e.g., `query = f"CREATE DATABASE {db} OWNER {config.db_user};"; cmd = f"-u postgres psql -c {shlex.quote(query)}"`) or use argument arrays where supported.
+
+## 2026-06-03 - [CRITICAL] Prevent Command Injection via Unescaped Variables in sed
+**Vulnerability:** In `automation/ops/fix_web_console_config.py`, the `config.ksc_fqdn` variable was directly interpolated into a `sed` replace expression (e.g., `f"-e 's/\\$web_console_address\\$/{config.ksc_fqdn}/g'"`). If this variable contains single quotes (`'`), it can break out of the shell string and lead to command injection. If it contains forward slashes (`/`), it can prematurely terminate the `sed` expression, causing syntax errors or worse.
+**Learning:** Interpolating unescaped configuration values into shell strings is highly dangerous. Even when wrapping strings in single quotes, user-controlled input containing `'` or shell metacharacters can cause the command to break out and execute arbitrary commands under `sudo`. Moreover, when dealing with `sed`, special characters acting as delimiters must be explicitly escaped.
+**Prevention:** First, escape any characters acting as delimiters in the `sed` expression (e.g., `safe_fqdn = config.ksc_fqdn.replace('/', r'\/')`). Then, use `shlex.quote()` on the *entire* inner expression or argument (e.g., `arg2 = shlex.quote(f's/\\$web_console_address\\$/{safe_fqdn}/g')`) before interpolating it into the final shell command string. Do not manually wrap individual substituted variables in quotes.

automation/ops/fix_web_console_config.py

@@ -4,6 +4,7 @@
 """
 
 import logging
+import shlex
 from automation.python.config import KscConfig
 from automation.python.remote import connect_ksc_host, run_remote_sudo
 from automation.python.logging_utils import (
@@ -32,11 +33,15 @@ def fix_web_console_config(config: KscConfig, apply: bool = False) -> None:
     )
 
     # Comando de correção usando sed
+    # Sanitize and safely quote parameters interpolated into the shell command
+    # Any '/' must be escaped for the sed substitute expression
+    safe_fqdn = config.ksc_fqdn.replace('/', r'\/')
+    arg1 = shlex.quote(r's/\$web_console_port\$/8080/g')
+    arg2 = shlex.quote(f's/\\$web_console_address\\$/{safe_fqdn}/g')
+    arg3 = shlex.quote(r's/"port": "13000"/"port": "13299"/g')
+
     sed_cmd = (
-        "sed -i "
-        r"-e 's/\$web_console_port\$/8080/g' "
-        f"-e 's/\\$web_console_address\\$/{config.ksc_fqdn}/g' "
-        "-e 's/\"port\": \"13000\"/\"port\": \"13299\"/g' "
+        f"sed -i -e {arg1} -e {arg2} -e {arg3} "
         "/var/opt/kaspersky/ksc-web-console/server/config.json"
     )