Command Injection via Build Arguments (HIGH)

[nithin434]

The Problem:
Command-line build arguments flow directly into Docker containers and shell commands without any validation. An attacker can inject malicious commands through --build_args parameter.

Location:
tools\tests\systemtests\SystemtestArguments.py
tools\tests\docker-compose.template.yaml

Proof of Attack:
python systemtests.py --build_args="PRECICE_REF:v3.0;rm -rf /;whoami"

Real Damage:

• CI/CD Compromise: Steal GitHub secrets, AWS credentials, deployment keys
• Supply Chain Attack: Inject backdoors into Docker images distributed to users
• Data Theft: Exfiltrate source code, test data, intellectual property
• Infrastructure Takeover: Gain control of build servers, pivot to network