T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/html-to-pdf.sh:43- Finding
Chromium Sandbox Disabled While Rendering Potentially Untrusted HTML
- Content
View full analysis
/dev/null ``` ### Technical Analysis The PDF conversion script accepts a caller-supplied HTML file and opens it in headless Chrome or Chromium with the `--no-sandbox` option. HTML documents may contain JavaScript, embedded frames, active browser content, and references to remote resources. The Chromium sandbox is a defense-in-depth boundary intended to contain compromised renderer processes. Disabling it does not directly grant code execution, but it substantially increases the impact of a successful Chromium vulnerability. If attacker-controlled HTML exploits a browser rendering or JavaScript-engine vulnerability, the compromised renderer will not be contained by Chromium's normal process sandbox. The script also does not otherwise isolate the browser process or restrict the input document's network access. Therefore, untrusted documents should not be rendered using this configuration. ### Attack Path 1. An attacker creates an HTML document containing content that exploits a vulnerability in the installed Chrome or Chromium version. 2. The attacker persuades a user or automated workflow to process the document with `scripts/html-to-pdf.sh`. 3. The script launches the browser with `--no-sandbox` and loads the attacker-controlled document through a `file://` URL. 4. The malicious content triggers the browser vulnerability. 5. Because Chromium's sandbox is disabled, the resulting compromise is not constrained by the browser's normal renderer sandbox. 6. Attacker code may execute with the operating-system privileges of the account runni ...[truncated 897 chars]- Remediation
View remediation