T09 · Insecure Skill Coding Practices
- Location
scripts/execute_experiment.py:103- Finding
Destructive CCE node shutdown bypasses declared confirmation and validation gates
- Content
View full analysis
Vulnerability Details
File Location:
scripts/execute_experiment.py:103-106, 186-195
Supporting Location:scripts/generate_experiment.py:31-35, 120-129
Vulnerability Type: Missing authorization enforcement for a destructive cloud operation
Risk Level: HighVulnerable Code
scripts/execute_experiment.py:103-106defines dry-run support but provides no explicit confirmation or approval argument:python parser = argparse.ArgumentParser(description="Execute CCE AZ power outage experiment") parser.add_argument("--experiment-dir", required=True, help="Experiment directory path") parser.add_argument("--dry-run", action="store_true", help="Simulate without actual API calls") parser.add_argument("--auto-rollback", action="store_true", help="Auto-rollback on failure") args = parser.parse_args()scripts/execute_experiment.py:186-195performs the real shutdown whenever--dry-runis absent:python print(f"[2/6] Shutdown: executing BatchStopServers (os_stop={os_stop}) ...") phase_start = now_iso() if args.dry_run: print(" [DRY RUN] Skipping actual shutdown") else: try: result = batch_stop_servers(instance_ids, region, os_stop) job_id = result.get("job_id", "") print(f" ✓ BatchStopServers command sent (job_id: {job_id})")The generated configuration explicitly declares that confirmation is required in
scripts/generate_experiment.py:120-129:python "safety": { "max_duration_seconds": args.duration, "auto_rollback_on_failure": False, "require_confirmation": True, "check_pdb": True, "check_cross_az_capacity": True, },The validation file is loaded in
scripts/generate_experiment.py:31-35, but its result is not checked before producing an executable experiment:python validation = None if args.validation_file and os.path.exists(args.validation_file): with open(args.validation_f ...[truncated 3485 chars]- Remediation
View remediation
Remediation Suggestions
-
Enforce explicit confirmation in the executor. For non-dry-run execution, require a value bound to the experiment, such as:
bash python3 scripts/execute_experiment.py \ --experiment-dir "$EXP_DIR" \ --confirm-experiment "<experiment-name>"Reject execution unless the supplied value exactly matches the loaded experiment name or a newly generated approval token.
-
Honor
safety.require_confirmation. Read this field before any cloud mutation. If it is true, fail closed unless confirmation has been obtained through an explicit, auditable mechanism. -
Require successful validation. Refuse generation and execution unless a validation artifact exists and contains
all_compatible: true. Do not merely load the file. -
Cryptographically or structurally bind validation to the action. Record and verify the validated region, cluster ID, AZ, node names, ECS instance IDs, discovery timestamp, and a digest of the target set. Reject stale or mismatched validation results.
-
Revalidate immediately before shutdown. Confirm that every ECS instance still corresponds to a node in the selected cluster and AZ, and rerun the critical capacity and single-AZ checks.
-
Use fail-closed target constraints. Reject empty IDs, duplicate IDs, unknown nodes, mismatched AZ labels, and instance IDs not returned by fresh discovery for the selected cluster.
-
Make dry-run the safe default. Require a separate explicit option such as
--executein addition to confirmation before issuingBatchStopServers. -
Improve rollback guarantees. Enable rollback-on-failure by default, persist rollback state before shutdown, and prominently report any failed startup operation for immediate intervention.
-