T09 · Insecure Skill Coding Practices
Error
- Location
scripts/diagnose.js:194- Finding
Shell Command Injection Through Feishu User Allowlist Values
- Content
View full analysis
/dev/null`, { encoding: 'utf8' } ); ``` ### Technical Analysis The `allowFrom` array originates from `~/.openclaw/openclaw.json` or automatically discovered backup files. Although `JSON.stringify()` produces valid JSON, it does not escape values for safe insertion into a POSIX shell command. The JSON string is placed inside single quotes and passed to `execSync()`, which invokes a shell. An allowlist entry containing a single quote can terminate the quoted argument and introduce shell syntax. For example, a malicious value shaped like `' ; ; #` can cause the shell to execute the inserted command when the repair path calls `fixAllowFrom()`. The issue is reachable when the diagnostic logic identifies an `allowFrom` problem and automatically invokes the repair function. ### Attack Path 1. An attacker or compromised local process gains the ability to modify `~/.openclaw/openclaw.json` or one of the discovered `openclaw.json.bak*` files. 2. The attacker inserts shell metacharacters and a single quote into an `allowFrom` entry. 3. The user invokes `scripts/diagnose.js`. 4. The diagnostic check detects a missing or invalid `allowFrom` configuration. 5. `fixAllowFrom()` serializes the attacker-controlled array and interpolates it into a shell command. 6. `execSync()` passes the constructed string to the shell. 7. The injected command executes with the privileges of the user running the skill. ### Impact Assessment Successful exploitation provides arbitrary command execution as the agent user. The attacker could read or modify files available to that user, access OpenClaw and Feishu credentials, alter agent configuration, send ...[truncated 224 chars]- Remediation
View remediation