T09 · Insecure Skill Coding Practices
Warning
- Location
gaode_skill.py:19- Finding
Unauthenticated Local IPC Through a Predictable Unix Socket Path
- Content
View full analysis
dict: """ Connect to the Electron application's Unix Domain Socket, send a command, and wait for the result. """ if not os.path.exists(SOCKET_PATH): raise FileNotFoundError( f"Socket file does not exist: {SOCKET_PATH}\n" "Start the Amap Electron application first." ) client_socket = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) client_socket.settimeout(SOCKET_TIMEOUT_SECONDS) try: client_socket.connect(SOCKET_PATH) message = json.dumps(command_payload, ensure_ascii=False) + "\n" client_socket.sendall(message.encode("utf-8")) ``` ### Technical Analysis The client communicates with a local Electron service through the fixed path `/tmp/jsapi-electron.sock`. The `/tmp` directory is shared among local users, while the client only checks whether an object exists at the expected path. The code does not verify: - That the path refers to a Unix socket. - That the socket is owned by the current user or the expected application user. - That the socket has appropriately restrictive permissions. - The credentials of the process accepting the connection. - The authenticity or integrity of messages exchanged with the service. Consequently, a local attacker may create a malicious socket at the predictable path before the legitimate Electron service starts. The Skill would connect to the attacker's listener and transmit command payloads containing search terms, named locations, coordinates, and route endpoints. The attacker can also return syntactically valid but malicious JSON. Although the re ...[truncated 1735 chars]- Remediation
View remediation