T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/enable-autostart.sh:60
- Finding
- Executable Configuration and Unsafe systemd Unit Generation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/enable-autostart.sh`, lines 60 and 117–139; related configuration sourcing also occurs in `scripts/mount-cloud.sh`, line 43 **Vulnerability Type**: Shell code execution through sourced configuration and unsafe service-file construction **Risk Level**: Medium ### Vulnerable Code ```bash source "$CONFIG_FILE" ``` ```bash # Create systemd user service file create_service() { mkdir -p "$SERVICE_DIR" log_info "Creating systemd user service file..." cat > "$SERVICE_FILE" << EOF [Unit] Description=Cloud Storage Mount ($CLOUD_REMOTE) After=network-online.target Wants=network-online.target [Service] Type=forking Environment="HOME=$HOME" ExecStart=$RCLONE_BIN mount $CLOUD_REMOTE: $MOUNT_POINT --daemon --vfs-cache-mode writes --vfs-cache-max-size 1G ExecStop=/bin/fusermount -u $MOUNT_POINT || /bin/true Restart=on-failure RestartSec=10 StartLimitBurst=3 StartLimitInterval=60s # Resource limits MemoryMax=512M MemoryHigh=256M [Install] WantedBy=default.target EOF log_info "Service file created: $SERVICE_FILE" } ``` The original script messages and comments are localized, but the executable statements above are reproduced without changing their behavior. ### Technical Analysis The script treats `~/.config/cloud-mount/config.sh` as trusted executable shell code by loading it with `source`. A configuration file is therefore not merely data: command substitutions, function calls, redirections, and arbitrary shell statements in that file execute with the privileges of the account running the script. The script subsequently inserts `CLOUD_REMOTE`, `MOUNT_POINT`, `HOME`, and `RCLONE_BIN` directly into a generated systemd service. These values are not checked for newlines, control characters, whitespace, or systemd directive syntax. A crafted value can consequently modify the generated unit or add directives. Because the unit is enabled for future sessions, service-file injection can turn a on ...[truncated 1716 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not use `source` to load configuration data. Parse a fixed set of keys with a strict parser. 2. Reject unknown keys, command substitutions, shell metacharacters, embedded newlines, and control characters. 3. Validate `CLOUD_REMOTE` against the rclone remote-name grammar. 4. Canonicalize `MOUNT_POINT`, require an absolute user-owned path, and reject newline characters. 5. Generate systemd units with correctly escaped arguments, such as values processed with `systemd-escape`, or invoke a fixed wrapper script whose arguments are stored in a non-executable environment file. 6. Create configuration and service files with restrictive permissions, preferably `0600`, and verify that they are owned by the invoking user. 7. Detect and reject execution as root unless a separately designed administrative mode genuinely requires it. 8. Remove documentation that applies `sudo` to the user-service script. 9. Add tests covering spaces, quotes, semicolons, command substitutions, and newline injection in every configuration field. ]]>