T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/crawlora.sh:149
- Finding
- Curl Startup Configuration Can Undermine Fixed-Destination Credential Protection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 149–167 **Vulnerability Type**: Curl startup configuration injection affecting API credential confidentiality **Risk Level**: Medium ### Vulnerable Code ```bash auth=(--config "$curl_config") if [ "$method" = "GET" ]; then # -G + --data-urlencode URL-encodes each value (so spaces etc. are safe). qs=() for kv in ${rest[@]+"${rest[@]}"}; do [ -n "$kv" ] || continue # curl treats both @file and name@file forms as local-file input for # --data-urlencode. Reject @ outright so query arguments cannot disclose # local files to the Crawlora API. case "$kv" in *@*) echo "@ is not allowed in query arguments" >&2; exit 2 ;; esac qs+=(--data-urlencode "$kv") done curl -fsS -G "${auth[@]}" ${qs[@]+"${qs[@]}"} "${base}${path}" else [ -n "$body" ] || body="${rest[0]:-}" [ -n "$body" ] || body='{}' # Stream the body on stdin so curl never interprets a user value as its # @file shorthand (and cannot read local files supplied in a request body). printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" --data-binary @- "${base}${path}" fi ``` ### Technical Analysis The helper attempts to protect `CRAWLORA_API_KEY` by storing the authentication header in a mode-`0600` temporary curl configuration file and using a fixed HTTPS API base URL. However, neither curl invocation begins with `-q` or `--disable`. Curl may automatically load a user startup configuration such as `.curlrc` before processing ordinary command-line options. If an attacker can influence that configuration file or curl's configuration lookup environment, the attacker may inject options that change transfer behavior or add an additional URL. The authentication header loaded through `--config "$curl_config"` may then be applied to an unintended transfer. This does not constitute a direct remote exploit by itself. Exploitation require ...[truncated 1987 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Disable automatic curl startup configuration loading by placing `-q` as the first argument of every curl invocation: ```bash curl -q -fsS -G "${auth[@]}" ${qs[@]+"${qs[@]}"} "${base}${path}" ``` ```bash printf '%s' "$body" | curl -q -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" --data-binary @- "${base}${path}" ``` Additional hardening should include: 1. Preserve the fixed HTTPS API base URL and route allowlist. 2. Continue storing the API key in a mode-`0600` temporary configuration file and deleting it on exit. 3. Consider explicitly controlling proxy behavior in environments where proxy variables or proxy configuration may be attacker-influenced. 4. Add automated tests that run the helper with a malicious `.curlrc` and verify that no startup directives are honored. 5. Document that search terms, dates, locations, and other request data are transmitted to Crawlora as part of the service's expected operation. ]]>