T09 · Insecure Skill Coding Practices
Error
- Location
- bootstrap-local-standalone.sh:114
- Finding
- Arbitrary Shell Execution Through a Sourced Runtime Environment File<![CDATA[ ## Vulnerability Details **File Location**: `bootstrap-local-standalone.sh`, lines 4–6 and 114–119 **Vulnerability Type**: Unsafe sourcing of externally controllable configuration **Risk Level**: High ### Vulnerable Code ```bash RUNTIME_DIR="${AIONIS_RUNTIME_DIR:-${SKILL_DIR}/.runtime}" ENV_FILE="${RUNTIME_DIR}/aionis.env" CLAWBOT_ENV_FILE="${RUNTIME_DIR}/clawbot.env" ``` ```bash if [[ -f "$ENV_FILE" ]]; then # shellcheck disable=SC1090 source "$ENV_FILE" memory_api_key="$(extract_api_key "${MEMORY_API_KEYS_JSON:-}")" admin_token="${ADMIN_TOKEN:-}" fi ``` ### Technical Analysis The script treats `aionis.env` as executable shell code by loading it with `source`. A shell environment file is not merely parsed as key-value data: command substitutions, function definitions, redirections, and arbitrary shell commands inside the file are executed with the privileges of the user running the bootstrap script. The file location is also influenced by the caller-controlled `AIONIS_RUNTIME_DIR` environment variable. Consequently, an attacker who can control this variable, pre-create the default `.runtime/aionis.env`, or modify a runtime directory shared with another user can cause the bootstrap operation to execute attacker-supplied commands. The script does not verify the file's owner, permissions, canonical path, or content before sourcing it. ### Attack Path 1. The attacker creates an `aionis.env` file containing a shell payload, for example a command that copies credentials or installs additional software. 2. The attacker places it in the default `.runtime` directory or causes the victim to invoke the script with `AIONIS_RUNTIME_DIR` pointing to the attacker's directory. 3. The victim runs the documented command: ```bash bash ./bootstrap-local-standalone.sh ``` 4. The script reaches `source "$ENV_FILE"`. 5. Bash executes the attacker's commands with the victim's current privileges before the Docker container is started. ### Impact A ...[truncated 473 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not use `source` to read runtime configuration. - Parse only explicitly permitted keys, such as `MEMORY_API_KEYS_JSON` and `ADMIN_TOKEN`, using a non-executing parser. - Reject malformed lines, command substitutions, shell metacharacters, duplicate keys, and unexpected variables. - Resolve and validate the canonical runtime path before accessing it. - Require the runtime directory and configuration file to be owned by the invoking user and not writable by groups or other users. - If existing credentials must be retained, store them in a dedicated secret file with a narrowly defined format rather than an executable shell file. - Add automated tests proving that values such as `$(touch /tmp/pwned)` are treated as inert text and never executed. ]]>