T09 · Insecure Skill Coding Practices
Error
- Location
scripts/crypto_utils.py:63- Finding
Wallet Name Path Traversal and Symbolic-Link File Overwrite
- Content
View full analysis
dict: """Load an encrypted wallet from disk.""" wallet_file = KEYSTORE_DIR / f"{name}.json" if not wallet_file.exists(): raise FileNotFoundError(f"Wallet '{name}' not found") with open(wallet_file, 'r') as f: return json.load(f) ``` Wallet names reach these functions from command-line arguments at `scripts/wallet_manager.py:82` and `scripts/wallet_manager.py:88`. ### Technical Analysis The application directly interpolates an untrusted wallet name into a filesystem path without validating its characters, resolving the resulting path, or confirming that it remains under `KEYSTORE_DIR`. A wallet name containing parent-directory components, such as `../../target`, causes the resulting path to escape the intended keystore directory. Because the `.json` suffix is appended automatically, any user-writable JSON path that can be represented relative to the keystore can be targeted. The write operation uses the ordinary `open(..., 'w')` interface. It therefore follows an existing symbolic link and truncates its target. The subsequent `chmod(0o600)` may also alter the permissions of the resolved target. The corresponding load operation has the same traversal weakness and can open JSON files outside the keystore. ### Attack Pa ...[truncated 1546 chars]- Remediation
View remediation