T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/install.sh:7- Finding
Privileged fail2ban action executes a script from a potentially user-writable directory
- Content
View full analysis
Vulnerability Details
File Location:
scripts/install.sh:7, 28-34
Vulnerability Type: Privilege escalation through an unsafe privileged script reference
Risk Level: HighVulnerable Code
bash SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" # Create fail2ban action cat > /etc/fail2ban/action.d/skillboss-reporter.conf << CONF [Definition] actionban = bash $SCRIPT_DIR/report-single.sh <ip> "SSH brute-force on <name> jail (fail2ban auto-report)" [Init] CONFTechnical Analysis
The installer creates a system-level fail2ban action that invokes
report-single.shfrom the Skill's original directory. The project documentation recommends copying the project into~/.clawdbot/skills/fail2ban-reporter/, which would ordinarily remain writable by the owning non-root user.Fail2ban actions commonly execute with the privileges of the fail2ban daemon, typically root. The installer does not:
- Copy the callback into a root-owned system directory.
- Verify ownership or permissions on the callback or its parent directories.
- Remove write access from unprivileged accounts.
- Use a trusted wrapper that validates the target script.
- Quote the generated script path.
Consequently, the root-managed action configuration can reference mutable, non-root-controlled code. Any account or process capable of changing
report-single.shcan replace its contents with arbitrary shell commands, which fail2ban will execute upon a subsequent ban event.This is a privilege-boundary violation rather than evidence that the currently shipped callback is malicious.
Attack Path
- An administrator installs the action with
sudo bash scripts/install.sh. - The installer writes
/etc/fail2ban/action.d/skillboss-reporter.conf. - The action permanently points to
scripts/report-single.shin the original Skill directory. - A lower-privileged user or compromised process with write access to that directory modifies
report-single.shand inserts arbitrary commands ...[truncated 912 chars]
- Remediation
View remediation
Remediation Suggestions
- During installation, copy
report-single.shinto a dedicated system directory, such as/usr/local/libexec/skillboss-reporter/report-single.sh. - Make the deployed directory and script root-owned and non-writable by unprivileged users:
bash install -d -o root -g root -m 0755 /usr/local/libexec/skillboss-reporter install -o root -g root -m 0755 \ "$SCRIPT_DIR/report-single.sh" \ /usr/local/libexec/skillboss-reporter/report-single.sh- Configure fail2ban to invoke only the root-owned deployed copy:
ini [Definition] actionban = /usr/bin/bash /usr/local/libexec/skillboss-reporter/report-single.sh <ip> "SSH brute-force on <name> jail (fail2ban auto-report)"- Verify that the callback file and every parent directory are owned by root and are not writable by group or other users before restarting fail2ban.
- Use fixed absolute paths for executables used by privileged actions.
- Quote paths when generating configuration and reject paths containing line breaks or other unsafe characters.
- Consider executing the network-reporting callback through a dedicated restricted service account instead of root. Grant only the minimum file and network access required.
- Store API credentials in a root-owned service environment file with restrictive permissions rather than relying on the invoking user's environment.
- On uninstall, remove the root-owned deployed callback and directory in addition to the fail2ban action configuration.
- During installation, copy