T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/pve.sh:7
- Finding
- Credential File Is Executed as Arbitrary Shell Code## Vulnerability Details **File Location**: `scripts/pve.sh`, lines 7–10 **Vulnerability Type**: Unsafe configuration-file execution **Risk Level**: High **Vulnerable Code**: ```bash # Load credentials if [[ -f ~/.proxmox-credentials ]]; then source ~/.proxmox-credentials fi ``` ### Technical Analysis The script loads `~/.proxmox-credentials` with the Bash `source` built-in. This does not parse the file as inert key-value configuration; it executes every statement in the file within the current shell process. Consequently, any shell command, command substitution, function definition, variable expansion, or redirection inserted into the credential file runs with the privileges of the user invoking `pve.sh`. The script only checks whether the path exists. It does not verify file ownership, permissions, file type, or content before execution. The file is also sourced whenever it exists, even if all required credentials have already been supplied through environment variables. This conflicts with the documented environment-first fallback behavior and unnecessarily exposes environment-based invocations to the executable configuration file. ### Attack Path 1. An attacker or compromised local process obtains write access to the victim's `~/.proxmox-credentials` file or replaces it through an insecure surrounding setup. 2. The attacker inserts a shell command, such as a command that copies files, installs user-level persistence, or invokes another executable. 3. The victim runs any `scripts/pve.sh` command. 4. Bash executes the injected statement when processing `source ~/.proxmox-credentials`. 5. The malicious command inherits the victim's account privileges, environment, and access to the Proxmox token subsequently used by the script. ### Impact Assessment Successful exploitation provides arbitrary command execution as the local user running the helper. The attacker can access files available to that account, s ...[truncated 307 chars]
- Remediation
- ## Remediation Suggestions - Do not use `source` to load credential data. - Parse an explicit allowlist of `PROXMOX_HOST`, `PROXMOX_TOKEN_ID`, and `PROXMOX_TOKEN_SECRET` as data. - Reject malformed entries, unexpected keys, command substitutions, control characters, and shell metacharacters. - Require the credential path to be a regular file owned by the current user and inaccessible to group or other users. - Load the file only when one or more required environment variables are absent. - Prefer a structured credential store or operating-system secret manager where practical. - Fail closed if ownership or permission validation fails.