T09 · Insecure Skill Coding Practices
Error
- Location
- book_meeting.py:132
- Finding
- Unsafe Deserialization of a User-Controllable OAuth Token File<![CDATA[ ## Vulnerability Details **File Location**: `book_meeting.py:132-134` **Vulnerability Type**: Unsafe Python pickle deserialization **Risk Level**: High ### Vulnerable Code ```python if os.path.exists(token_path): with open(token_path, 'rb') as token: creds = pickle.load(token) ``` ### Technical Analysis The application restores cached OAuth credentials using `pickle.load()`. Python pickle data is executable serialization: a crafted pickle can invoke arbitrary functions while it is being deserialized. The token path defaults to `meeting_token.pickle` in the current working directory and can also be selected through the `--token-path` argument. The application performs no ownership, permission, file-type, symlink, integrity, or authenticity checks before deserialization. Consequently, any party capable of planting or replacing the selected token file can cause code execution when the Skill starts. The payload executes before Calendar or Meet operations and does not require a valid Google token. ### Attack Path 1. An attacker gains write access to the directory from which the Skill will be launched, or convinces the user to supply an attacker-controlled file through `--token-path`. 2. The attacker creates a malicious pickle object whose reduction routine invokes an arbitrary command or Python callable. 3. The attacker saves it as `meeting_token.pickle` or at the user-selected token path. 4. The user invokes `book_meeting.py`. 5. The `pickle.load(token)` call reconstructs the malicious object and executes its payload. 6. The payload runs with the operating-system privileges of the user invoking the Skill. ### Impact Assessment Successful exploitation provides arbitrary code execution under the invoking user's account. The attacker could read or modify user-accessible files, access environment variables and credentials, steal other local tokens, invoke network services, or alter the meeting-booking operation. The vulnerability does not ...[truncated 117 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace pickle storage with a non-executable format such as JSON. - Serialize only the credential fields required to reconstruct a `google.oauth2.credentials.Credentials` instance. - Store tokens in a dedicated user configuration directory created with mode `0700`. - Create token files atomically with mode `0600`. - Reject symbolic links and non-regular files. - Verify that an existing token file is owned by the current user and is not accessible by group or other users. - If backward compatibility is required, do not automatically deserialize legacy pickle files. Provide an explicit, isolated migration process with strong ownership and permission validation, then delete the legacy file. ]]>