T09 · Insecure Skill Coding Practices
- Location
scripts/inject-via-cdp.sh:7- Finding
Shell Arguments Are Interpolated into Executable Node.js Source
- Content
View full analysis
Vulnerability Details
File Location:
scripts/inject-via-cdp.sh, lines 7-27
Vulnerability Type: Shell-to-JavaScript command injection
Risk Level: HighVulnerable Code
bash SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" TARGET_ID="${1}" CDP_ENDPOINT="${2:-http://127.0.0.1:18800}" # Use node to inject via CDP Runtime.evaluate node -e " const fs = require('fs'); const http = require('http'); const scriptContent = fs.readFileSync('${SCRIPT_DIR}/page-controller-global.js', 'utf8'); const injectContent = fs.readFileSync('${SCRIPT_DIR}/inject.js', 'utf8'); const combined = scriptContent + ';\n' + injectContent; // Use CDP to evaluate const ws = require('ws') || null; async function injectViaCDP() { // Get WebSocket URL for the target const listUrl = '${CDP_ENDPOINT}/json'; const resp = await fetch(listUrl); const pages = await resp.json(); const target = pages.find(p => p.id === '${TARGET_ID}');Technical Analysis
The script constructs a JavaScript program inside a double-quoted shell string passed to
node -e.TARGET_ID,CDP_ENDPOINT, and the derivedSCRIPT_DIRare inserted directly into single-quoted JavaScript literals without JavaScript escaping or separation between code and data.A value containing a single quote followed by JavaScript syntax can terminate the intended string literal and inject statements into the generated Node.js program. Shell quoting of the original positional arguments does not prevent this issue because the vulnerable interpretation occurs later, when Node.js parses the assembled source code.
The injected code runs in the local Node.js process rather than merely in the target browser page. It therefore has the filesystem, process, and network privileges of the user who invoked the script.
Attack Path
- An attacker gains influence over the target ID or CDP endpoint supplied to
inject-via-cdp.sh. This can occur t ...[truncated 1341 chars]
- An attacker gains influence over the target ID or CDP endpoint supplied to
- Remediation
View remediation
Remediation Suggestions
- Remove the inline
node -eprogram and delegate to the existingscripts/inject-cdp.mjsimplementation using ordinary process arguments. - If an inline program must be retained, read values from
process.argvor environment variables so they remain data rather than generated source code. - Do not interpolate shell variables into JavaScript string literals.
- Validate
TARGET_IDagainst the expected identifier format, such as a strict allowlist of alphanumeric characters and limited punctuation. - Parse
CDP_ENDPOINTwith the URL API and permit only explicitly approved schemes and hosts. If remote CDP is unnecessary, restrict it to loopback addresses. - Pass the script directory as an argument and resolve it using Node.js path APIs.
- Add regression tests containing quotes, backslashes, newlines, template syntax, and JavaScript metacharacters in every externally supplied argument.
- Remove the inline