T09 · Insecure Skill Coding Practices
- Location
scripts/upload.sh:4- Finding
Arbitrary Local File Upload Due to Missing Image Validation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/upload.sh, lines 4–14
Vulnerability Type: Unrestricted local file upload to an external service
Risk Level: Mediumbash FILE="${1:?Usage: upload.sh <image-path>}" TOKEN="${INFINIMO_TOKEN:-${INFINIMO_API_KEY:?Set INFINIMO_TOKEN or INFINIMO_API_KEY}}" if [[ ! -f "$FILE" ]]; then echo "Error: file not found: $FILE" >&2 exit 1 fi curl -s -X POST "https://www.clawec.com/api/upload/image" \ -H "Token: $TOKEN" \ -F "file=@${FILE}" \Technical Analysis
The script accepts an arbitrary path and verifies only that it refers to a regular file. It does not validate the file's content-derived MIME type, extension, size, canonical location, or image decodability. Although the skill documentation describes this operation as accepting only
image/*, the client does not enforce that restriction before transmitting the file.Consequently, any readable regular file can be submitted to the external
www.clawec.comservice. Shell command injection is not evident because the path is quoted, but quoting does not prevent disclosure of the selected file's contents.Attack Path
- An attacker influences the reference-image path supplied in a task or invocation.
- The attacker supplies a path to a sensitive readable file rather than a genuine image.
upload.shchecks the path with[[ -f "$FILE" ]]; the check succeeds for a regular sensitive file.curl -F "file=@${FILE}"reads the local file and transmits its contents tohttps://www.clawec.com/api/upload/image.- The remote service receives the file, resulting in unauthorized disclosure if server-side validation does not reject it before retaining or processing its contents.
Impact Assessment
Exploitation does not grant additional local privileges; it is limited to files readable by the account running the skill. Within that boundary, it may disclose credentials, environment f ...[truncated 333 chars]
- Remediation
View remediation
Remediation Suggestions
- Resolve the supplied path to its canonical form and allow uploads only from explicitly approved, user-selected directories.
- Reject symbolic links and revalidate the opened file to reduce link-based and path-substitution risks.
- Inspect the file content with a trusted MIME-detection mechanism and allow only required image formats, such as JPEG, PNG, and WebP.
- Decode the image with a maintained image library before upload; reject files that cannot be successfully decoded.
- Enforce conservative file-size and image-dimension limits.
- Require explicit user confirmation that identifies the canonical local path and destination before transmitting the file.
- Prefer opening and validating the file once, then uploading the same descriptor or a securely created validated copy to reduce time-of-check/time-of-use risk.
- Treat server-side validation as defense in depth rather than relying on it as the sole control.