T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:53
- Finding
- Shell Command Injection Through an Unquoted MIME Charset Parameter## Vulnerability Details **File Location**: `SKILL.md`, lines 53-56 **Vulnerability Type**: Mailcap shell command injection **Risk Level**: High **Vulnerable Code**: ```text Create `~/.config/neomutt/mailcap` so w3m renders HTML parts: ``` text/html; w3m -I %{charset} -T text/html; copiousoutput; ``` ``` ### Technical Analysis The recommended mailcap command inserts `%{charset}` into a shell-interpreted command without quoting or validation. This value can originate from the `charset` parameter in an email's MIME `Content-Type` header, which is controlled by the message sender. If the mailcap implementation passes the expanded command through a shell, a malicious charset containing shell metacharacters can change the command's structure. As a result, rendering an attacker-supplied HTML message may execute an injected command rather than merely passing a charset value to `w3m`. ### Attack Path 1. A user installs the documented mailcap configuration. 2. An attacker sends the user an HTML email with a crafted MIME `charset` parameter containing shell syntax. 3. The user opens the message in NeoMutt. 4. NeoMutt selects the documented mailcap handler for the HTML body. 5. The attacker-controlled charset is substituted into the unquoted command. 6. The shell interprets the injected metacharacters and executes the attacker's command with the NeoMutt user's privileges. ### Impact Assessment Successful exploitation can provide arbitrary command execution under the local account running NeoMutt. The attacker could read or alter files accessible to that account, access email configuration and credentials, modify shell configuration, or install user-level persistence. The vulnerability does not directly grant root privileges, but its scope includes all resources available to the affected user.
- Remediation
- ## Remediation Suggestions - Do not interpolate attacker-controlled MIME parameters directly into shell commands. - Prefer a fixed charset where practical, for example by invoking `w3m` with a predetermined safe encoding. - If dynamic charset support is required, use a dedicated wrapper that strictly allowlists recognized charset names, such as alphanumeric names with narrowly permitted separators. - Have the wrapper invoke `w3m` using an argument array without a shell. - Reject unexpected values rather than attempting to escape arbitrary input. - Test the hardened handler against MIME parameters containing spaces, quotes, semicolons, command substitutions, redirections, and newline characters.