T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/auth-flow.sh:43
- Finding
- Remote API responses are interpolated into executable Python source<![CDATA[ ## Vulnerability Details **File Location**: `scripts/auth-flow.sh:43-59`; `scripts/refresh-token.sh:18-34` **Vulnerability Type**: Python source injection through untrusted remote responses **Risk Level**: Critical ### Vulnerable Code `scripts/auth-flow.sh:43-59`: ```bash if echo "$TOKEN_RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); assert 'access_token' in d" 2>/dev/null; then # 保存 credentials mkdir -p "$HOME/.caremax" python3 -c " import json from datetime import datetime, timedelta resp = json.loads('''$TOKEN_RESPONSE''') creds = { 'access_token': resp['access_token'], 'refresh_token': resp['refresh_token'], 'expires_at': (datetime.utcnow() + timedelta(seconds=resp['expires_in'])).isoformat() + 'Z', 'scope': resp['scope'], 'base_url': '$BASE_URL' } json.dump(creds, open('$CREDS_FILE', 'w'), indent=2) print(json.dumps({'status': 'authorized', 'access_token': resp['access_token'], 'base_url': '$BASE_URL'})) " ``` `scripts/refresh-token.sh:18-34`: ```bash if echo "$RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); assert 'access_token' in d" 2>/dev/null; then python3 -c " import json from datetime import datetime, timedelta resp = json.loads('''$RESPONSE''') creds = json.load(open('$CREDS_FILE')) creds['access_token'] = resp['access_token'] creds['expires_at'] = (datetime.utcnow() + timedelta(seconds=resp['expires_in'])).isoformat() + 'Z' json.dump(creds, open('$CREDS_FILE', 'w'), indent=2) print(json.dumps({ 'status': 'refreshed', 'access_token': resp['access_token'], 'base_url': creds.get('base_url', 'https://api.caremax.ai') })) " ``` ### Technical Analysis Both scripts retrieve JSON from a remote endpoint and first confirm that the response parses as JSON and contains an `access_token`. They subsequently interpolate the original, untrusted response directly into the source text passed to `python3 -c`. JSON validation does not make this interpolation safe. A valid JS ...[truncated 2276 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Never insert network responses, tokens, URLs, file paths, or other variable data into dynamically generated Python source. Pass the response through standard input: ```bash printf '%s' "$TOKEN_RESPONSE" | python3 -c ' import json import os import sys from datetime import datetime, timedelta, timezone resp = json.load(sys.stdin) required = { "access_token": str, "refresh_token": str, "expires_in": int, "scope": str, } for field, expected_type in required.items(): if not isinstance(resp.get(field), expected_type): raise ValueError(f"Invalid or missing field: {field}") creds = { "access_token": resp["access_token"], "refresh_token": resp["refresh_token"], "expires_at": ( datetime.now(timezone.utc) + timedelta(seconds=resp["expires_in"]) ).isoformat(), "scope": resp["scope"], "base_url": os.environ["CAREMAX_BASE_URL"], } # Write credentials safely here. ' ``` Apply the same pattern to `refresh-token.sh`. Pass the credential path and base URL through validated command-line arguments or environment variables rather than embedding them in Python code. Additional hardening should include: - Validate the complete response schema and field types. - Reject unexpected response sizes and malformed token fields. - Restrict custom endpoints as described in the separate endpoint-trust finding. - Add regression tests containing apostrophes, triple quotes, newlines, and Python-like text in every server-controlled field. ]]>