T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/dokploy-config.sh:31
- Finding
- Shell Command Injection Through Executable Configuration File Generation## Vulnerability Details **File Location**: `scripts/dokploy-config.sh:31-38` **Vulnerability Type**: Persistent shell command injection **Risk Level**: High ### Vulnerable Code ```bash # Save to config file mkdir -p "$(dirname "$CONFIG_FILE")" cat > "$CONFIG_FILE" << EOF export DOKPLOY_API_URL="${DOKPLOY_API_URL}" export DOKPLOY_API_KEY="${DOKPLOY_API_KEY}" EOF log_success "Config saved to $CONFIG_FILE" log_info "Run: source $CONFIG_FILE to load" ``` ### Technical Analysis User-controlled values supplied through `--url` and `--key` are inserted directly into an executable shell file. The values are not escaped or validated for quotation marks, newlines, command substitutions, or other shell syntax. Expansion while generating the file does not safely encode the resulting value. An input containing a closing quotation mark and a newline can terminate the intended `export` statement and add arbitrary shell commands. The script then explicitly directs the user to execute the generated file with `source`. For example, a malicious URL value can cause the generated file to contain: ```bash export DOKPLOY_API_URL="https://example.invalid" attacker_command #" ``` This is persistent until `~/.dokployrc` is replaced and executes in the context of every shell that subsequently sources the file. ### Attack Path 1. An attacker supplies or recommends a crafted `--url` or `--key` value containing quotation marks, a newline, and a shell command. 2. The user or Agent runs `dokploy-config set` with that value. 3. The script writes the attacker-controlled shell syntax to `~/.dokployrc`. 4. The user follows the displayed instruction and runs `source ~/.dokployrc`, or sources it later from another shell initialization workflow. 5. The injected command executes with the privileges of that user. ### Impact Assessment Successful exploitation permits arbitrary command execution under the account running the Skil ...[truncated 331 chars]
- Remediation
- ## Remediation Suggestions - Do not store configuration in an executable shell file. - Use a non-executable data format such as JSON and parse it with `jq`. - Validate the API URL with an explicit scheme and host policy. - Reject carriage returns, newlines, null bytes, and other control characters in configuration values. - If shell-format output is unavoidable, encode values with a shell-safe mechanism such as `printf '%q'` and test round-trip behavior. - Remove instructions that encourage sourcing attacker-influenced files. - Replace existing configuration files atomically after validating all inputs.