T09 · Insecure Skill Coding Practices
Error
- Location
scripts/diagnose.sh:64- Finding
Shell Command Injection Through the IMAP Server Environment Variable
- Content
View full analysis
&1 | grep -q succeeded" 2>/dev/null; then echo -e "${GREEN}✓ 可连接${NC}" else echo -e "${YELLOW}⚠ 无法测试连接${NC}" fi fi ``` ### Technical Analysis The `EMAIL_IMAP_SERVER` environment variable is interpolated directly into a command string passed to `bash -c`. Because `bash -c` reparses the resulting string as shell syntax, an attacker-controlled value can contain command separators, command substitutions, redirections, or other shell metacharacters. The initial nonempty-variable check does not validate the value. Quoting the entire command argument to `bash -c` also does not protect the embedded value after interpolation. For example, a value containing `; attacker_command; #` could terminate the intended `nc` command and execute an additional command. The injected command would run with the same operating-system privileges as the diagnostic script. ### Attack Path 1. An attacker obtains control over, or convinces a user to set, the `EMAIL_IMAP_SERVER` environment variable. 2. The attacker places shell syntax and an arbitrary command in the variable. 3. The user or Agent invokes `diagnose.sh email`. 4. The script interpolates the malicious value into the `bash -c` command string. 5. Bash parses and executes the injected command. 6. If the Skill runs as `root`, the injected command receives root-level access to the host. ### Impact Assessment Successful exploitation provides arbitrary local command execution with the privileges of the Skill process. In the documented deployment paths, the Skill accesses `/root/.openclaw`, suggesting that it may operate in a highly privileged context. P ...[truncated 341 chars]- Remediation
View remediation
/dev/null 2>&1; then echo -e "${GREEN}✓ Reachable${NC}" fi else echo "Invalid IMAP server value" >&2 return 1 fi ``` Apply the following controls: 1. Validate the value against an allowlist suitable for DNS hostnames and supported IP-address formats. 2. Never construct shell source code from environment variables. 3. Use `--` where supported to prevent option injection. 4. Run diagnostics under a dedicated, unprivileged account. 5. Add regression tests using values containing `;`, `$()`, backticks, newlines, redirections, and leading hyphens. ]]>