T09 · Insecure Skill Coding Practices
Error
- Location
scripts/start_dashboard.sh:39- Finding
Unrelated Processes Can Be Terminated Based Only on Port Ownership
- Content
View full analysis
/dev/null 2>&1; then existing_pid="$(lsof -ti "tcp:$PROJECT_OS_PORT" 2>/dev/null | head -n 1 || true)" fi if [[ -n "$existing_pid" && "$restart" -eq 0 ]]; then printf 'Dashboard already running at http://%s:%s (pid %s)\n' "$PROJECT_OS_HOST" "$PROJECT_OS_PORT" "$existing_pid" exit 0 fi if [[ -n "$existing_pid" && "$restart" -eq 1 ]]; then kill "$existing_pid" sleep 1 fi ``` The related easy-mode stop operation has the same issue: ```bash stop) pid="" if command -v lsof >/dev/null 2>&1; then pid="$(lsof -ti "tcp:$PROJECT_OS_PORT" 2>/dev/null | head -n 1 || true)" fi if [[ -n "$pid" ]]; then kill "$pid" printf 'Stopped dashboard PID %s\n' "$pid" else printf 'Dashboard is not running.\n' fi ;; ``` ### Technical Analysis The scripts treat any process listening on `PROJECT_OS_PORT` as the Project OS dashboard. They do not verify the process executable, command line, ownership, start time, or relationship to the dashboard PID file before issuing `kill`. This is especially relevant because the documented smoke-test workflow calls: ```bash start_dashboard.sh --detach --restart ``` Consequently, normal first-run behavior can terminate an unrelated application that happens to occupy the configured port. Although the signal is sent with the invoking user's privileges and does not itself escalate privileges, the logic violates process isolation and can disrupt other same-user services. There is also a time-of-check/time-of-use concern: the PID returned by `lsof` is not tied to a validated process identity before termination. ### Attack Path 1. An unrelated service is started under the victim user's account and listens on port `87 ...[truncated 1006 chars]- Remediation
View remediation
/cmdline` on Linux or use an equivalent platform API. - Verify that the process command matches the expected Project OS dashboard invocation. - Confirm that its configured database, host, and port match the current instance where practical. 3. If the configured port is occupied by an unrecognized process, fail safely with a message asking the user to choose another port. 4. Record process identity information alongside the PID, such as start time or a random instance identifier, to reduce PID-reuse risk. 5. Apply the same validation to both `start_dashboard.sh --restart` and `easy_mode.sh dashboard stop`. 6. Remove stale PID files only after confirming that the recorded process no longer exists or is not the expected dashboard. ]]>