T09 · Insecure Skill Coding Practices
- Location
index.js:214- Finding
Arbitrary Shell Command Injection Through Bundle Content
- Content
View full analysis
Vulnerability Details
File Location:
index.js, lines 214–220
Vulnerability Type: OS command injection through unsafe shell-command construction
Risk Level: HighVulnerable Code
javascript const { execSync } = require('child_process'); const data = fs.readFileSync(filePath, 'utf8'); try { const result = execSync('curl -s -X POST ' + EVOMAP_API + ' -H "Content-Type: application/json" -d \'' + data + '\'', { encoding: 'utf8' }); const response = JSON.parse(result);Technical Analysis
publishBundle()reads the contents of a user-selected bundle file and directly concatenates them into a command passed tochild_process.execSync(). BecauseexecSync()executes the constructed string through a shell, shell metacharacters indataare interpreted as command syntax.The request body is enclosed in single quotes, but bundle content is not escaped. A single quote in any attacker-controlled JSON string can terminate the quoted
curlargument. The attacker can then append shell commands and use further syntax, such as a comment marker, to neutralize the remainder of the generated command. Apostrophes are valid JSON string content, so the expected input format does not prevent this condition.Parsing and rewriting by
fixBundle()do not provide shell escaping. Attacker-controlled fields such as summaries, signals, strategies, and other retained properties can therefore carry the injection payload into the subsequent publishing operation.Attack Path
- An attacker creates or modifies an EvoMap bundle containing shell syntax in a JSON string field.
- The victim obtains that bundle and invokes either:
node index.js publish <bundle.json>, ornode index.js publish-all <directory>.
fixBundle()parses and rewrites the bundle but preserves attacker-controlled data fields.publishBundle()reads the resulting file as raw text.- The raw text is ...[truncated 1135 chars]
- Remediation
View remediation
Remediation Suggestions
-
Eliminate shell execution from the publication path. Use Node.js
fetch()orhttps.request()and pass the bundle as the HTTP request body:javascript async function publishBundle(filePath) { const data = fs.readFileSync(filePath, 'utf8'); const parsed = JSON.parse(data); const response = await fetch(EVOMAP_API, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(parsed) }); if (!response.ok) { throw new Error(`Publish failed with HTTP ${response.status}`); } return await response.json(); } -
If invoking
curlis unavoidable, useexecFileSync()orspawn()with a separate argument array and shell processing explicitly disabled. Do not construct a command string:javascript const { execFileSync } = require('child_process'); const result = execFileSync( 'curl', [ '-s', '-X', 'POST', EVOMAP_API, '-H', 'Content-Type: application/json', '--data-binary', data ], { encoding: 'utf8', shell: false } ); -
Parse the file as JSON and validate its schema before publication. This is defense in depth and must not replace removal of shell interpolation.
-
Add regression tests containing apostrophes and shell metacharacters in every user-controlled string field. Verify that these values are transmitted literally and never executed.
-
Propagate publication failures safely and avoid printing sensitive server responses or command details to logs.
-