T09 · Insecure Skill Coding Practices
Error
- Location
scripts/login.py:311- Finding
Arbitrary File Deletion Through the Custom Cookie Path During Logout
- Content
View full analysis
str: profile = _profile(args) paths = profile_paths(profile) if profile: os.environ["XHS_PROFILE"] = profile if getattr(args, "cookie", None): return args.cookie return str(paths.cookie_path) ``` ```python # scripts/__main__.py:185 result = login.logout( cookie_path=_cookie_path(args), user_data_dir=_user_data_dir(args), ) ``` ```python # scripts/__main__.py:576 parser.add_argument("--cookie", "-c", help="Cookie file path", default=None) ``` ```python # scripts/login.py:311-323 def logout(cookie_path=None, user_data_dir=None): """Delete persistent browser data and Cookie file to reset login state.""" import shutil paths = profile_paths(env_profile()) data_dir = user_data_dir or str(paths.user_data_dir) if os.path.exists(data_dir): shutil.rmtree(data_dir) path = cookie_path or DEFAULT_COOKIE_PATH if os.path.exists(path): os.remove(path) ``` ### Technical Analysis The global `--cookie` option accepts an unrestricted path. The logout command passes this value through `_cookie_path()` to `login.logout()`, where the path is deleted with `os.remove()`. The deletion target is not canonicalized or checked against the selected Xiaohongshu profile directory. The code also does not verify that the target is the expected cookie backup, a regular file, or a non-symlink. Consequently, any existing file writable by the process can be selected as the alleged cookie file and deleted. This behavior exceeds the legitimate scope of logout, which should only remove Xiaohongshu session artifacts. ### Attack Path 1. An attacker influences an Agent, automation w ...[truncated 1222 chars]- Remediation
View remediation