T09 · Insecure Skill Coding Practices
- Location
scripts/submit_seedance_2_mini.sh:9- Finding
Unvalidated Local File Submission to an External API
- Content
View full analysis
Vulnerability Details
File Location:
scripts/submit_seedance_2_mini.sh, lines 9–17
Vulnerability Type: Arbitrary local file disclosure through an unvalidated file argument
Risk Level: MediumVulnerable Code
bash payload_file="$1" curl --fail-with-body --request POST \ --url "https://api.poyo.ai/api/generate/submit" \ --header "Authorization: Bearer ${POYO_API_KEY}" \ --header "Content-Type: application/json" \ --data @"${payload_file}"Technical Analysis
The script accepts an arbitrary path as its only positional argument and passes that path directly to
curlusing--data @file. This syntax instructscurlto read the referenced local file and transmit its contents to the external PoYo API.The path is correctly quoted, so this is not shell command injection. However, the script does not verify that the supplied path:
- Refers to a regular file rather than a symbolic link or special file.
- Is located in an approved payload directory.
- Contains valid JSON.
- Conforms to the expected Seedance request schema.
- Is within a reasonable size limit.
Consequently, an attacker who can influence the script argument could cause any file readable by the executing user to be transmitted to PoYo. The fixed HTTPS destination limits the exfiltration destination, but it does not prevent disclosure to that third party.
Attack Path
- An attacker, malicious instruction, or untrusted automation input influences the argument supplied to
submit_seedance_2_mini.sh. - The attacker supplies the path of a sensitive file instead of a prepared JSON payload, for example a readable credentials or configuration file.
- The script assigns that path to
payload_filewithout validation. curl --data @"${payload_file}"reads the file under the privileges of the user running the skill.- The file contents are sent in the request body to `https://api.poyo.ai/api/generate/subm ...[truncated 817 chars]
- Remediation
View remediation
Remediation Suggestions
- Resolve the supplied path to its canonical form and require it to remain within a dedicated, trusted payload directory.
- Require the target to be a regular file and reject symbolic links, devices, FIFOs, sockets, and other special files.
- Apply a conservative maximum file-size limit before reading or submitting the payload.
- Parse the file with a JSON parser and reject invalid JSON.
- Validate the request schema before submission, including the required
modelandinputfields. - Require
modelto equalseedance-2-miniand validate supported input fields and value ranges. - Reject unexpected top-level fields where practical.
- Consider reading the validated JSON into memory and passing the validated serialization to
curl, rather than allowingcurlto dereference an arbitrary caller-selected path. - Run the script with least-privilege filesystem access so unrelated secrets are not readable even if argument validation is bypassed.