T07 · Tool Hijacking and Spoofing
Error
- Location
- SKILL.md:69
- Finding
- Unverified Reusable COC Script Is Executed as Root## Vulnerability Details **File Location**: `SKILL.md`, lines 69 and 226–231 **Vulnerability Type**: Untrusted COC script reuse leading to privileged remote code execution **Risk Level**: High **Relevant Code:** ```markdown 1. **Check existing** — Call `ListScripts --cli-region=<coc_region>` with `--name_like="coc_ssh_key_setup"`. If found, record `script_uuid` and skip step 2. ``` ```json "execute_param": { "execute_user": "root", "success_rate": 100, "timeout": 120, "script_params": [{ ``` ```bash hcloud COC ExecuteScript --cli-region=<coc_region> \ --cli-jsonInput=<temp_dir>/coc_execute.json ``` ### Technical Analysis The Skill searches for an existing COC script using the fuzzy `name_like` filter and instructs the agent to reuse the returned `script_uuid`. It does not require validation of the script's exact name, owner, type, body, version, parameters, or digest before execution. The reused script is subsequently executed with `execute_user` set to `root` on all selected ECS targets. Therefore, a COC principal able to create or modify scripts can place a matching document containing attacker-selected commands. The Skill then treats that document as trusted solely because its name matches the search. This crosses the trust boundary between COC content controlled by another account principal and privileged execution on the operator's ECS instances. It constitutes a tool/API hijacking vulnerability rather than evidence that the Skill author intended to compromise systems. ### Attack Path 1. An attacker obtains permission within the same cloud account to create or modify COC scripts, without necessarily having direct root access to the target ECS instances. 2. The attacker creates a malicious COC shell script with a name matching `coc_ssh_key_setup`, or modifies an existing matching script. 3. A user invokes the Skill for legitimate ECS targets. 4. The Skill calls `ListScripts` with `--name_like="coc_ssh_key_setup"`. 5. The malicious or mod ...[truncated 882 chars]
- Remediation
- ## Remediation Suggestions - Do not reuse a script based only on a fuzzy name match. - Prefer creating a uniquely named, per-run COC script and deleting it after execution. - If reuse is required, retrieve the complete script definition and verify: - Exact script name - Expected owner or creator - Script type - Canonical script body or a pinned cryptographic digest - Exact parameter names, sensitivity flags, and schema - Expected version and execution policy - Reject ambiguous results and refuse execution when multiple scripts match. - Never execute an existing script as root unless all integrity checks succeed. - Where operationally possible, use a dedicated least-privileged execution account rather than `root`. - Ensure permissions to create and modify reusable COC documents are restricted and separated from permissions to invoke this workflow.