T09 · Insecure Skill Coding Practices
- Location
scripts/dronemobile.py:37- Finding
Unsafe Vehicle Selection Fallback Can Execute Commands on the Wrong Vehicle
- Content
View full analysis
Vulnerability Details
File Location:
scripts/dronemobile.py, lines 37–48
Vulnerability Type: Unsafe fail-open resource selection
Risk Level: HighVulnerable Code:
python def get_vehicle(client, device_key=None): vehicles = client.get_vehicles() if not vehicles: print("ERROR: No vehicles found on account") sys.exit(1) if device_key: for v in vehicles: dk = str(v.info.device_key) if hasattr(v, 'info') else str(getattr(v, 'device_key', '')) if dk == str(device_key): return v print(f"WARNING: Device key {device_key} not found — using first vehicle") return vehicles[0]Technical Analysis
The vehicle-selection function fails open when the configured
DRONEMOBILE_DEVICE_KEYdoes not match any returned vehicle. Instead of terminating, it warns the user and returnsvehicles[0]. It also automatically chooses the first vehicle whenever no device key is configured, regardless of how many vehicles exist on the account.This is particularly dangerous because the selected object is subsequently used for safety- and security-sensitive physical commands, including engine start, engine stop, door unlock, and trunk opening. A stale or mistyped key, a change in the dependency's vehicle object structure, or a change in API ordering can result in a command targeting an unintended vehicle.
Attack Path
- A DroneMobile account contains multiple registered vehicles.
DRONEMOBILE_DEVICE_KEYis absent, mistyped, stale, or fails to match because the dependency exposes the key through an unexpected object structure.- A user or agent requests a command such as
start,unlock, ortrunk. get_vehicle()fails to identify the intended vehicle.- The function silently returns the first vehicle from
client.get_vehicles(). - The requested physical-control command executes against that unintend ...[truncated 636 chars]
- Remediation
View remediation
Remediation Suggestions
Implement fail-closed and unambiguous vehicle selection:
- If an explicit device key is supplied but no exact match is found, terminate without executing any command.
- If no device key is supplied, automatically select a vehicle only when exactly one vehicle exists.
- If multiple vehicles exist, require an explicit device key or another stable unique identifier.
- Validate that each vehicle exposes a usable device key before command dispatch.
- Display and confirm the selected vehicle's non-sensitive name or identifier before safety-sensitive operations.
- Add tests covering absent keys, invalid keys, duplicate or missing identifiers, multiple vehicles, and changes in vehicle ordering.
A safer implementation would follow this logic:
python def get_vehicle(client, device_key=None): vehicles = client.get_vehicles() if not vehicles: raise RuntimeError("No vehicles found on account") if device_key: matches = [] for vehicle in vehicles: info = getattr(vehicle, "info", None) actual_key = getattr(info, "device_key", None) if actual_key is None: actual_key = getattr(vehicle, "device_key", None) if actual_key is not None and str(actual_key) == str(device_key): matches.append(vehicle) if len(matches) != 1: raise RuntimeError("Configured device key did not uniquely identify a vehicle") return matches[0] if len(vehicles) != 1: raise RuntimeError("Multiple vehicles found; DRONEMOBILE_DEVICE_KEY is required") return vehicles[0]