# Command injection via config values

Config or CRD values reaching shell/exec sinks without escaping; check sibling engines and dispatch layers

_Area: Cloud and container security. Seen in 3 disclosed reports; one confirmed bounty: $60,000; latest 2026-07-08. Updated 2026-10-24._

## How it works
A trusted component builds a shell command by concatenating values it treats as data: URLs, header keys, event bodies, model references. The assumption that breaks is that these values are inert. They are not — they reach `/bin/sh -c` or `bash -c`, where metacharacters (`$()`, backticks, quotes, `;`) are re-interpreted as code. The sink is the shell string; the source is a config field the attacker can influence.

## Where it shows up
- `fmt.Sprintf`/string concatenation feeding `sh -c`, `bash -c`, `exec` with a single string argument.
- `strconv.Quote` used as if it were shell quoting (it escapes `"` and `\`, not `$()` or backticks).
- Regexes like `[^?]+` that admit shell metacharacters into a parsed field.
- CRD/config fields (URLs, model refs, header keys, event bodies) with no validation before use.
- A sibling component passing args as an array while this one builds a string — a strong tell.

## How to review
Trace every config/CRD value to its exec sink. The invariant: user-influenced values must reach the process as separate argv elements, never interpolated into a shell string. If a shell is unavoidable, values must be single-quoted with internal quotes escaped, or passed via environment/stdin. Check the dispatch layer, not just the named feature: when a vendor blocks one connector or engine, look for siblings reaching the same sink [E1](https://bugbountylibrary.com/r/blog%3Aorca-security-resources-blog-synlapse-critical-azure-synapse-analytics-service-vulnerability.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-324q-cwx9-7crr.md). Confirm CRD validation rejects metacharacters [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-324q-cwx9-7crr.md).

## Variants seen
- ODBC SAML plugin builds shell command from `LOGIN_URL`; connector-type bypass reaches the same sink via sibling types [E1](https://bugbountylibrary.com/r/blog%3Aorca-security-resources-blog-synlapse-critical-azure-synapse-analytics-service-vulnerability.md).
- Cron trigger header keys interpolated verbatim inside double quotes; event body via `strconv.Quote` leaving `$()` intact [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-v5px-423j-pf7p.md).
- Startup probe script interpolates regex-parsed URL ref and `?model=` param run via `bash -c`, no CRD validation [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-324q-cwx9-7crr.md).

## Why fixes fail
Blocklisting a connector or feature name leaves sibling types that instantiate the same dangerous sink [E1](https://bugbountylibrary.com/r/blog%3Aorca-security-resources-blog-synlapse-critical-azure-synapse-analytics-service-vulnerability.md). Quoting with `strconv.Quote` looks safe but is not shell quoting [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-v5px-423j-pf7p.md).

## Impact and severity
RCE in shared integration runtimes, enabling cross-tenant credential and workspace identity theft [E1](https://bugbountylibrary.com/r/blog%3Aorca-security-resources-blog-synlapse-critical-azure-synapse-analytics-service-vulnerability.md); persistent root RCE in CronJob pods from unauthenticated dashboard users [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-v5px-423j-pf7p.md); arbitrary command execution in model pods by CRD writers [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-324q-cwx9-7crr.md). Severity rises with shared runtimes, broad credentials, and low-privilege input paths.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aorca-security-resources-blog-synlapse-critical-azure-synapse-analytics-service-vulnerability.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-v5px-423j-pf7p.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-324q-cwx9-7crr.md