T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/update.sh:50
- Finding
- Arbitrary Shell Code Execution Through Notification Configuration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/update.sh`, lines 50-52 **Vulnerability Type**: Executable configuration file / shell code injection **Risk Level**: High ### Vulnerable Code ```bash ENV_FILE="${OPENCLAW_DIR}/.telegram-notify.env" if [ -f "$ENV_FILE" ]; then set -a; source "$ENV_FILE"; set +a fi ``` ### Technical Analysis The notification configuration is documented as a key-value environment file, but the script loads it with Bash's `source` builtin. `source` does not parse data-only environment assignments; it interprets the entire file as shell code. Consequently, command substitutions, functions, redirections, pipelines, and arbitrary commands placed in `.telegram-notify.env` execute with the privileges of the user running `update.sh`. Checking only that the path is a regular file does not verify ownership, permissions, or content safety. For example, a malicious configuration could contain: ```bash TELEGRAM_BOT_TOKEN="$(malicious-command)" TELEGRAM_CHAT_ID="123" ``` The command would execute immediately while the file is sourced. ### Attack Path 1. An attacker gains the ability to create or modify `$OPENCLAW_DIR/.telegram-notify.env`, such as through another compromised process, an insecure restore, or overly permissive file permissions. 2. The attacker inserts shell commands or command substitution syntax into the file. 3. The victim runs `bash scripts/update.sh`, including with `--dry-run` or `--test-notify`. 4. Bash sources the file before processing the requested operation. 5. The injected command executes as the victim user. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user invoking the updater. The attacker could read or modify user-accessible files, steal OpenClaw or Telegram credentials, alter workspaces, tamper with update state, or establish user-level persistence. This code does not independently elevate privileges beyond those of the invo ...[truncated 14 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not use `source` for a data-only configuration file. - Parse only an explicit allowlist of keys, such as `TELEGRAM_BOT_TOKEN` and `TELEGRAM_CHAT_ID`, without shell evaluation. - Reject command substitutions, unexpected keys, malformed lines, and duplicate assignments. - Verify that the file is a regular file owned by the current user and is not group- or world-writable. - Require restrictive permissions such as mode `0600`. - Prefer a structured format such as JSON and parse it with a non-executing parser. A safe implementation should read values as literal data and never evaluate the file as Bash syntax. ]]>