T09 · Insecure Skill Coding Practices
- Location
scripts/submit_image_translator.sh:9- Finding
Unvalidated File Path Allows Arbitrary Local File Submission
- Content
View full analysis
Vulnerability Details
File Location:
scripts/submit_image_translator.sh, lines 9–16
Vulnerability Type: Unrestricted local file upload to an external service
Risk Level: Mediumbash payload_file="$1" curl --fail-with-body --request POST \ --url "https://api.poyo.ai/api/generate/submit" \ --header "Authorization: Bearer ${POYO_API_KEY}" \ --header "Content-Type: application/json" \ --data @"${payload_file}"Technical Analysis
The script accepts an unrestricted path as its only argument and supplies that path directly to curl using
--data @file. It does not verify that the path identifies a regular JSON file, reject symbolic links, constrain the file to an approved directory, or validate its contents against the expected image-translator request schema.Consequently, any readable local file can be selected as the HTTP request body. Although the remote API may reject content that is not valid JSON, curl transmits the content before the server validates it. This creates a local-file disclosure primitive when an attacker or untrusted automation can influence the script argument.
The bearer token is also interpolated into curl's command-line arguments. Depending on operating-system process visibility and isolation settings, another local user or process may be able to observe the authorization header while curl is running.
Attack Path
- A user or automated agent invokes the submission script in an environment containing a valid
POYO_API_KEY. - An attacker, untrusted instruction, or compromised workflow controls or influences the script's file-path argument.
- The attacker supplies the path of a sensitive file readable by the invoking account, including a path reached through a symbolic link.
- The script performs no file-type, path, or JSON-schema validation.
- Curl reads the selected file and transmits its contents to
https://api.poyo.ai/api/generate/submit. - The ...[truncated 741 chars]
- A user or automated agent invokes the submission script in an environment containing a valid
- Remediation
View remediation
Remediation Suggestions
- Resolve the supplied path to its canonical form and require it to reside inside a dedicated, trusted payload directory.
- Require a regular file and reject symbolic links, device files, named pipes, and other special file types.
- Parse the file with a trusted JSON parser before transmission and reject malformed content.
- Validate the complete request schema, including:
- An exact
modelvalue ofpoyo-ai/image-translator. - An
inputobject containing only supported fields. - A bounded
image_urlsarray. - Valid source and target language values.
- An optional callback URL using an approved scheme and, where appropriate, an allowlisted destination.
- An exact
- Prefer constructing the JSON request internally from individually validated parameters rather than accepting an arbitrary file path.
- Apply a conservative payload-size limit before reading or transmitting the file.
- Avoid placing the bearer token directly in process arguments where the platform permits safer alternatives, such as a permission-restricted temporary curl configuration or an HTTP client that sets headers internally.
- Ensure any temporary credential-bearing file is created with restrictive permissions, is not logged, and is securely removed after use.