T09 · Insecure Skill Coding Practices
Error
- Location
scripts/play-local-audio.sh:71- Finding
Configuration-Controlled Arbitrary Command Execution Through Custom Playback Backend
- Content
View full analysis
/dev/null 2>&1; then exec "$BACKEND" "$FILE" fi echo "unknown/unavailable backend: $BACKEND" >&2 exit 1 ;; ``` ### Technical Analysis The playback backend can be loaded from `config/tts-queue.json`. Although known backends are handled by dedicated branches, the default branch permits any value that resolves through `command -v`. The selected executable is then launched as: ```bash exec "$BACKEND" "$FILE" ``` Shell metacharacters inside `BACKEND` are not directly interpreted because the variable is quoted. Nevertheless, the absence of an executable allowlist creates an arbitrary program execution primitive. An attacker can select an interpreter such as `bash`, `python3`, or another executable available through `PATH`. The supplied audio-file argument then becomes input to that executable. For example, if `playback.backend` is set to `bash` and the requested “audio file” is an existing shell script, the script is executed rather than played. ### Attack Path 1. The attacker obtains the ability to modify `config/tts-queue.json`, influence first-run setup values, or otherwise control the playback backend argument. 2. The attacker sets `playback.backend` to an interpreter or attacker-controlled executable available through `PATH`. 3. The attacker creates or selects an existing file that passes the script's ` ...[truncated 773 chars]- Remediation
View remediation