← All KD5FMU repositories
SkywarnPlus
https://github.com/KD5FMU/SkywarnPlus
· Python · 4 findings · Review date 2026-07-11
Executive Summary
AlertScript executes configurable shell commands; DTMF SkyControl toggles features without caller authentication.
> [!CAUTION]
Summary Counts
Quick Reference
| ID | Severity | Category | File | Lines | Finding |
|---|
| SKYWARNPLUS-001 |
High |
Security |
SkywarnPlus.py |
1172-1279 |
AlertScript executes arbitrary shell commands from config.yaml |
| SKYWARNPLUS-002 |
High |
Security |
SkyControl.py |
193-260 |
DTMF SkyControl toggles config without authentication |
| SKYWARNPLUS-003 |
Medium |
Security |
SkywarnPlus.py |
881-884 |
shell=True for Asterisk playback commands |
| SKYWARNPLUS-004 |
Medium |
Security |
CustomAlertScript.py |
32-51 |
CustomAlertScript injects alert titles into shell commands |
High Security Issues
[SKYWARNPLUS-001] AlertScript executes arbitrary shell commands from config.yaml
SkywarnPlus.py : 1172-1279
ActiveCommands, InactiveCommands, Mappings run user-defined BASH via subprocess.run(cmd, shell=True).
Impact: Tampered config.yaml executes arbitrary commands as cron user.
[SKYWARNPLUS-002] DTMF SkyControl toggles config without authentication
SkyControl.py : 193-260
Invoked via DTMF and rewrites config.yaml with no caller authentication.
Impact: Radio users who know DTMF codes can disable alerts or alter repeater behavior.
Medium Issues
[SKYWARNPLUS-003] shell=True for Asterisk playback commands
SkywarnPlus.py : 881-884
sayAlert builds shell strings for asterisk -rx rpt localplay with shell=True.
Impact: Tampered node numbers or paths could inject shell commands.
[SKYWARNPLUS-004] CustomAlertScript injects alert titles into shell commands
CustomAlertScript.py : 32-51
Alert titles interpolated into commands executed with shell=True.
Impact: Unusual NWS alert titles with metacharacters could execute commands.