T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/nexus.sh:579
- Finding
- Path Traversal Through Unvalidated Session Identifiers<![CDATA[ ## Vulnerability Details **File Location**: `scripts/nexus.sh:579-594`; related destructive operation at `scripts/nexus.sh:170-177` **Vulnerability Type**: Path traversal and unsafe filesystem operations **Risk Level**: High ### Vulnerable Code ```bash claim) CODE="${1:?Usage: nexus.sh claim <CODE> --agent-id ID}" [[ -z "$AGENT_ID" ]] && echo '{"error":"missing --agent-id"}' && exit 1 net_preamble http_request -X POST "$NEXUS_URL/v1/pair/$CODE/claim" \ -H "X-Agent-Id: $AGENT_ID" emit_response SESSION_ID=$(echo "$RESPONSE" | jq -r '.sessionId // empty') if [[ -n "$SESSION_ID" ]]; then mkdir -p "$NEXUS_DATA_DIR/$SESSION_ID" write_binding "$SESSION_ID" AGENT_FILE="$NEXUS_DATA_DIR/$SESSION_ID/agent" echo "$AGENT_ID" > "$AGENT_FILE" ``` The same unvalidated value can later reach a recursive deletion operation: ```bash cleanup_leave_state() { local sid="$1" alias_name="$2" rm -rf "$NEXUS_DATA_DIR/$sid" if [[ -n "$alias_name" ]]; then remove_alias "$alias_name" else local found found=$(reverse_alias "$sid") if [[ -n "$found" ]]; then remove_alias "$found" fi fi } ``` ### Technical Analysis The client documentation describes a session identifier as a 48-character hexadecimal value, but the script does not enforce that format before using the value as a filesystem path component. In the `claim` flow, `SESSION_ID` is read from a response supplied by the configured remote server. Shell quoting prevents shell metacharacter expansion, but it does not neutralize path components such as `..`. Consequently, a server response containing a value such as `../../../../tmp/target` causes the resulting path to resolve outside `~/.config/messaging/sessions`. The affected value is used by `mkdir`, `write_binding`, and redirections that create or overwrite fixed-name files called `server`, `agent`, and `key`. It can also reach `cleanup_leave_state`, where it is passed to `rm -rf` without canonicali ...[truncated 1684 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate every session identifier before using it in a URL or filesystem path: ```bash validate_session_id() { [[ "$1" =~ ^[a-fA-F0-9]{48}$ ]] || { echo '{"error":"invalid session identifier"}' return 1 } } ``` 2. Apply validation to: - User-supplied session identifiers. - Alias values loaded from `aliases.json`. - Session identifiers returned by `create` and `claim`. - Directory names enumerated from persisted state. 3. Canonicalize every state path and verify that it remains a direct child of `NEXUS_DATA_DIR` before writing or deleting it. 4. Replace recursive deletion based on externally derived values with narrowly scoped deletion of known files followed by `rmdir` of a validated session directory. 5. Treat malformed identifiers in server responses as protocol violations and abort without writing any local state. 6. Add regression tests using identifiers containing `..`, slashes, absolute paths, encoded separators, empty values, and identifiers longer or shorter than 48 hexadecimal characters. ]]>