T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/dronemobile.py:37
- Finding
- Unsafe Vehicle Selection Fallback Can Execute Commands on the Wrong Vehicle## Vulnerability Details **File Location**: `scripts/dronemobile.py`, lines 37–48 **Vulnerability Type**: Unsafe fail-open resource selection **Risk Level**: High **Vulnerable Code**: ```python def get_vehicle(client, device_key=None): vehicles = client.get_vehicles() if not vehicles: print("ERROR: No vehicles found on account") sys.exit(1) if device_key: for v in vehicles: dk = str(v.info.device_key) if hasattr(v, 'info') else str(getattr(v, 'device_key', '')) if dk == str(device_key): return v print(f"WARNING: Device key {device_key} not found — using first vehicle") return vehicles[0] ``` ### Technical Analysis The vehicle-selection function fails open when the configured `DRONEMOBILE_DEVICE_KEY` does not match any returned vehicle. Instead of terminating, it warns the user and returns `vehicles[0]`. It also automatically chooses the first vehicle whenever no device key is configured, regardless of how many vehicles exist on the account. This is particularly dangerous because the selected object is subsequently used for safety- and security-sensitive physical commands, including engine start, engine stop, door unlock, and trunk opening. A stale or mistyped key, a change in the dependency's vehicle object structure, or a change in API ordering can result in a command targeting an unintended vehicle. ### Attack Path 1. A DroneMobile account contains multiple registered vehicles. 2. `DRONEMOBILE_DEVICE_KEY` is absent, mistyped, stale, or fails to match because the dependency exposes the key through an unexpected object structure. 3. A user or agent requests a command such as `start`, `unlock`, or `trunk`. 4. `get_vehicle()` fails to identify the intended vehicle. 5. The function silently returns the first vehicle from `client.get_vehicles()`. 6. The requested physical-control command executes against that unintend ...[truncated 636 chars]
- Remediation
- ## Remediation Suggestions Implement fail-closed and unambiguous vehicle selection: 1. If an explicit device key is supplied but no exact match is found, terminate without executing any command. 2. If no device key is supplied, automatically select a vehicle only when exactly one vehicle exists. 3. If multiple vehicles exist, require an explicit device key or another stable unique identifier. 4. Validate that each vehicle exposes a usable device key before command dispatch. 5. Display and confirm the selected vehicle's non-sensitive name or identifier before safety-sensitive operations. 6. Add tests covering absent keys, invalid keys, duplicate or missing identifiers, multiple vehicles, and changes in vehicle ordering. A safer implementation would follow this logic: ```python def get_vehicle(client, device_key=None): vehicles = client.get_vehicles() if not vehicles: raise RuntimeError("No vehicles found on account") if device_key: matches = [] for vehicle in vehicles: info = getattr(vehicle, "info", None) actual_key = getattr(info, "device_key", None) if actual_key is None: actual_key = getattr(vehicle, "device_key", None) if actual_key is not None and str(actual_key) == str(device_key): matches.append(vehicle) if len(matches) != 1: raise RuntimeError("Configured device key did not uniquely identify a vehicle") return matches[0] if len(vehicles) != 1: raise RuntimeError("Multiple vehicles found; DRONEMOBILE_DEVICE_KEY is required") return vehicles[0] ```