T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/generate.js:31
- Finding
- Arbitrary File Overwrite Through User-Controlled Output Path## Vulnerability Details **File Location**: `scripts/generate.js`, lines 31–34 and 146 **Vulnerability Type**: Arbitrary file overwrite **Risk Level**: Medium ### Vulnerable Code ```js } else if (args[i] === '--output' && args[i+1]) { outputFile = args[i+1]; i++; } ``` ```js fs.writeFileSync(outputFile, Buffer.from(part.inlineData.data, 'base64')); ``` ### Technical Analysis The `--output` command-line argument is accepted as an unrestricted filesystem path and passed directly to `fs.writeFileSync`. The script does not canonicalize the path, restrict output to an approved directory, reject symbolic links, check whether the destination already exists, or use exclusive file creation. When image generation succeeds, `fs.writeFileSync` creates the selected file or truncates and replaces an existing file. Consequently, anyone able to control the script arguments can overwrite any file writable by the process account. This issue does not independently provide elevated operating-system privileges. Exploitation remains constrained by the permissions of the account running the skill. ### Attack Path 1. An attacker or untrusted caller invokes the skill with a crafted `--output` value pointing to an existing sensitive file or a path traversing outside the intended image directory. 2. The script accepts the path without validation. 3. The script sends the image-generation request to the configured API. 4. After receiving image data, the script decodes the Base64 response. 5. `fs.writeFileSync` truncates and replaces the selected target with image bytes. 6. The targeted file becomes corrupted or unusable. ### Impact Assessment Successful exploitation can destroy or corrupt user documents, application configuration, scripts, and other resources writable by the executing account. Overwriting a writable script or configuration file may produce secondary effects when another application later consumes it, al ...[truncated 255 chars]
- Remediation
- ## Remediation Suggestions - Store generated images only in a dedicated, application-controlled output directory. - Resolve the requested path with `path.resolve` and verify that it remains beneath the canonical approved directory. - Reject absolute paths, traversal components, symbolic-link destinations, and non-image extensions. - Use exclusive creation, such as `fs.writeFileSync(path, data, { flag: "wx" })`, to prevent replacement of existing files. - If replacement is a required feature, require explicit confirmation and verify that the existing destination is a regular file within the approved directory. - Create the output directory with restrictive permissions and run the skill under a least-privileged account. - Consider generating the destination filename internally rather than accepting an arbitrary caller-supplied path.