fix: escape SSM parameter values in eval-mode output to prevent shell injection

[svvitale]

Summary

Fixes SECOPS-25088: a HackerOne bug bounty submission reporting that unescaped SSM parameter values in aws-env's eval-mode output can allow shell command execution on the consuming host.

Vulnerability

When aws-env is invoked without a command argument, it prints export statements intended to be consumed via eval or source:

export VAR=$'<value>'

$'...' is ANSI-C quoting in bash/zsh. This quoting style terminates at an unescaped single quote. If an SSM parameter value contains a ', it breaks out of the quoted context. A malicious or attacker-controlled value such as:

foo'; rm -rf /; echo '

produces the following output:

export VAR=$'foo'; rm -rf /; echo ''

When eval'd by the shell, this executes rm -rf / with the permissions of the calling process.

Attack surface

Any caller using the eval-mode pattern (common in container entrypoints and shell scripts) is affected if an attacker can write a crafted value to an SSM parameter path that aws-env reads.

Fix

Added ansiCEscape() in cmd/aws-env/main.go which escapes the two characters with special meaning inside $'...':

• \ → \\ (must come first to avoid double-escaping)
• ' → \'

The same attack-payload value now produces:

export VAR=$'foo\'; rm -rf /; echo \''

The shell interprets this as a single literal string — no command boundary is introduced.

Testing

Added cmd/aws-env/main_test.go with unit tests covering:

• Plain values (no change)
• The injection payload from the ticket report
• Backslash handling
• Backslash immediately before a single quote (double-escaping check)
• Empty string
• Newlines (unaffected, passed through as-is)

All existing tests continue to pass.

References

• SECOPS-25088
• Related: OFFSEC-673

🤖 Generated with Claude Code

[semgrep-code-sendgrid]

Semgrep found 7 aws-sdk-go-v1 findings:

• cmd/aws-env/main.go
  • L3-24 - Triage
  • L3-23 - Triage
  • L3-22 - Triage
  • L3-20 - Triage
  • L3-19 - Triage
  • L3-18 - Triage
  • L3-17 - Triage

Usage of github.com/aws/aws-sdk-go (v1) detected.
This SDK has reached End of Life status on 2025-07-31.
You must migrate to aws-sdk-go-v2.

Need help with this issue? Consult our appsec team or ask in #help-appsec on Slack.