Bash Child/Parent Pipe Inheritance Exploit - bash

Question

#!/bin/bash
ipaddr=${1}
rdlnk=$(readlink /proc/$$/fd/0)
user=""
passwd=""
function get_input() {
if grep -Eq "^pipe:|deleted" <<< "${rdlnk}" || [[ -p "${rdlnk}" ]]; then
while IFS= read -r piped_input || break; do
[[ -z "${ipaddr}" ]] && ipaddr="${piped_input}" && continue
[[ -z "${user}" ]] && user="${piped_input}" && continue
[[ -z "${passwd}" ]] && passwd="${piped_input}" && continue
done
fi
echo "Got that IP address you gave me to work on: ${ipaddr}"
[[ -n "${user}" ]] && echo "[... and that user: ${user}]"
[[ -n "${user}" ]] && echo "[... and that users password: ${passwd}]"
}
get_input
exit 0
Normally it's fine:
$> process_ip.bsh 71.123.123.3
Got that IP address you gave me to work on: 71.123.123.3
But, put the parent into a piped loop and watch out:
$ echo -en "71.123.123.3\nroot\ntoor\n" | while read a; do echo "Parent loop, processing: ${a}"; grep -q '^[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}' <<< "${a}" && ./process_ip.bsh "$a"; done
Parent loop, processing: 71.123.123.3
Got that IP address you gave me to work on: 71.123.123.3
[... and that user: root]
[... and that users password: toor]
Ouch. The parent only wanted to provide the IP Address from its pipe to the child. Presuming that the parent must maintain an open pipe with sensitive data in it at the time of the fork to the child process. How can this be prevented?

Answer 1

process_ip.bsh, like any other process, inherits its standard input from its parent. This line
rdlnk=$(readlink /proc/$$/fd/0)
doesn't do exactly what you think it does. It only contains the name of the file the parent is using for standard input because the script is inheriting its standard input from the parent. ($$ is the process ID of the current shell because .process_ip.bsh is a separate process, not merely a subshell started by the parent.)
If you redirect input to process_ip.bsh, you are in complete control of what it receives.
while read a; do
echo "Parent loop, processing: ${a}"
grep -q '^[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}' <<< "${a}" &&
./process_ip.bsh "$a" < /dev/null
done <<EOF
71.123.123.3
root
toor
EOF