T09 · Insecure Skill Coding Practices
- Location
scripts/search_and_poll.sh:95- Finding
Non-Unique Job Correlation Can Return an Unintended Search Result
- Content
View full analysis
Vulnerability Details
File Location:
scripts/search_and_poll.sh, lines 95–105
Vulnerability Type: Improper correlation of asynchronous jobs
Risk Level: MediumVulnerable Code
python unwrap_data(run_json(cmd)) target = {"region": region, "keyword": keyword.strip(), "date": date, "aiInterpret": ai} log_id = None for _ in range(10): for item in (unwrap_data(run_json([logs_sh,"1","20"])).get("items") or []): p = item.get("param") or {} if (p.get("keyword") or "").strip() == keyword.strip() and (p.get("region") or "US") == region and str(p.get("date") or "") == date: log_id = item.get("id"); break if log_id: break time.sleep(min(poll_interval,3))Technical Analysis
The script submits a search but discards the submission response. It then attempts to locate the newly created record by listing the latest 20 account records and comparing only the keyword, region, and date.
Those parameters do not uniquely identify a submitted job. Different searches can share all three values, particularly when requests are repeated or an account is used concurrently. The script also creates a
targetobject containingaiInterpret, but never uses it. Other search options, such as ABA research, keyword mining, and keyword trends, are likewise excluded from the comparison.The first matching history record is accepted without checking whether multiple records match, whether its creation time corresponds to the current submission, or whether it was created by the current invocation. Consequently, the selected
log_idmay belong to an earlier or concurrent request.Attack Path
- Another user or process using the same ClawEC account submits a search with the same keyword, region, and month as the victim.
- The victim invokes
search_and_poll.shwith those same parameters. - The victim's search is submitted, but the response is discarded.
- The script requests the latest 20 account history records. ...[truncated 938 chars]
- Remediation
View remediation
Remediation Suggestions
- Preserve and parse the search-submission response, then use a unique server-issued job or log identifier to retrieve the corresponding result directly.
- If the API does not currently return an identifier, extend the API contract to return an immutable request ID.
- As a temporary fallback, record the submission time and match against a narrow creation-time window together with every submitted parameter, including
aiInterpret,abaResearch,keywordMiner, andkeywordTrend. - Detect multiple matching records and fail safely instead of selecting the first one.
- Avoid relying on ordering within the latest 20 history entries, since ordering and concurrent insertions do not establish ownership.
- Add concurrency tests that submit identical searches and verify that each invocation retrieves only its own result.