T07 · Tool Hijacking and Spoofing
Error
- Location
- agents/scanner/agent.cjs:8
- Finding
- Execution of Unverified Shell Scripts Outside the Audited Skill Package<![CDATA[ ## Vulnerability Details **File Location**: `agents/scanner/agent.cjs:8-11`, `agents/analyzer/agent.cjs:9`, `agents/researcher/agent.cjs:9` **Vulnerability Type**: Execution of unverified external tools **Risk Level**: High ### Vulnerable Code ```javascript // agents/scanner/agent.cjs:8-11 async function scan(){ try{ await new Promise((r,e)=>exec('~/aass-dataset/secure_dataset.sh scan 2>&1',{timeout:180000},(ex,out)=>ex?e(ex):r(out))); log('扫描完成'); ``` ```javascript // agents/analyzer/agent.cjs:9 await new Promise((r,e)=>exec('~/aass-scripts/3layer_scheduler.sh analyzer 2>&1',{timeout:300000},(ex,out)=>ex?e(ex):r(out))); ``` ```javascript // agents/researcher/agent.cjs:9 await new Promise((r,e)=>exec('~/aass-scripts/daily_intel.sh 2>&1',{timeout:600000},(ex,out)=>ex?e(ex):r(out))); ``` ### Technical Analysis The scanner, analyzer, and researcher agents execute shell scripts stored outside the audited project. These scripts are not included in the Skill, and the reviewed code does not validate their ownership, permissions, integrity, or expected contents before execution. The documented manager starts all three affected agent types. Consequently, invoking the normal start operation can execute code whose effective behavior is not represented by the reviewed package. The use of `child_process.exec` additionally invokes a shell, expanding the execution surface beyond what is required to launch a fixed local program. This is a local tool-hijacking risk: an attacker or compromised process capable of creating or replacing one of the referenced scripts can cause attacker-controlled commands to run under the identity of the user operating the Skill. No privilege escalation beyond that user's existing permissions is demonstrated. ### Attack Path 1. An attacker obtains write access to the current user's `~/aass-dataset` or `~/aass-scripts` directory, or creates the expected path before the legitimate component is installed. 2. The attacker pl ...[truncated 1029 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Package all required scanner, analyzer, and researcher implementations inside the audited Skill. 2. Resolve executable paths from `__dirname` rather than from mutable home-directory locations. 3. Replace `exec` with `spawn` or `execFile`, disable shell interpretation, and pass arguments as an array. 4. Before execution, validate that each executable: - Is a regular file rather than a symbolic link. - Is owned by the expected user or package owner. - Is not writable by untrusted users or groups. - Matches a cryptographically pinned hash or signed manifest. 5. Fail closed when integrity validation fails; do not silently substitute another executable. 6. Document every external component and its required permissions. 7. Run analysis components in a restricted subprocess or container with minimal filesystem and network access. ]]>