T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/create-workdir.sh:39
- Finding
- Path Traversal Through Unvalidated Workdir Topic<![CDATA[ ## Vulnerability Details **File Location**: `scripts/create-workdir.sh:39-52` **Vulnerability Type**: Path traversal and arbitrary file overwrite **Risk Level**: Medium ### Vulnerable Code ```bash # Validate topic format if [[ ! "$TOPIC" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}- ]]; then echo -e "${YELLOW}Warning: Topic should start with YYYY-MM-DD- for consistency${NC}" fi # Create directory structure WORKDIR="${WORKDIR_BASE}/${HOSTNAME}/${TOPIC}" OUTPUT_DIR="${WORKDIR}/output" echo -e "${GREEN}Creating workdir...${NC}" echo " Hostname: ${HOSTNAME}" echo " Topic: ${TOPIC}" echo " Path: ${WORKDIR}" ``` The affected path is subsequently created and files within it are overwritten: ```bash mkdir -p "${OUTPUT_DIR}" touch "${WORKDIR}/commands.md" touch "${WORKDIR}/summary.md" cat > "${WORKDIR}/commands.md" << EOF ``` ### Technical Analysis The `TOPIC` argument is incorporated directly into `WORKDIR`. The script checks only whether it starts with a date-like prefix, and a failed check produces a warning rather than terminating execution. It does not reject path separators, `..` components, or other traversal syntax. Shell quoting prevents command injection but does not prevent filesystem path traversal. A value containing traversal components can cause the normalized path to leave `${HOME}/.ssh-workdir/${HOSTNAME}`. The script then creates directories and truncates `commands.md` and `summary.md` at the resulting location. The hostname validation is appropriately restrictive, but it does not compensate for the unrestricted topic component. ### Attack Path 1. An attacker obtains the ability to influence arguments passed to `create-workdir.sh`. 2. The attacker supplies a topic containing traversal components, such as a date-prefixed value followed by `/../../`. 3. The format check accepts the date prefix or merely emits a warning. 4. `mkdir -p` resolves the traversal and creates the resulting directory outside the intended host workdir. 5. The here- ...[truncated 743 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Treat an invalid topic as a fatal error rather than a warning. - Restrict topics to one safe path component, for example: ```bash if [[ ! "$TOPIC" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}-[a-zA-Z0-9._-]+$ ]]; then echo "Error: Invalid topic format" >&2 exit 1 fi ``` - Explicitly reject `/`, `\`, `..`, control characters, and empty components. - Canonicalize the base and destination with `realpath` and verify that the destination remains below the canonical base directory. - Use `mkdir --` and other utilities with `--` before attacker-influenced operands. - Add automated tests covering absolute paths, traversal components, repeated separators, and control characters. ]]>