T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/manus.sh:74
- Finding
- Unrestricted Remote File Download and Local File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `scripts/manus.sh`, lines 74-92 **Vulnerability Type**: Unvalidated remote URL retrieval and unsafe file overwrite **Risk Level**: Medium ### Vulnerable Code ```bash download) # Download output files: manus.sh download <task_id> [output_dir] task_id="$1" output_dir="${2:-.}" mkdir -p "$output_dir" curl -s "$API_BASE/tasks/$task_id" \ -H "API_KEY: $MANUS_API_KEY" | jq -r '.output[]?.content[]? | select(.type == "output_file") | "\(.fileName)\t\(.fileUrl)"' | \ while IFS=$'\t' read -r filename url; do if [ -n "$filename" ] && [ -n "$url" ]; then # Sanitize filename safe_name=$(echo "$filename" | tr -cd '[:alnum:]._-' | head -c 100) [ -z "$safe_name" ] && safe_name="output_file" echo "Downloading: $safe_name" >&2 curl -sL "$url" -o "$output_dir/$safe_name" echo "$output_dir/$safe_name" fi done ;; ``` ### Technical Analysis The `download` action extracts `fileUrl` and `fileName` values from a remote API response and passes the URL directly to `curl -L`. It does not validate the URL scheme or destination hostname. Redirect following is enabled without validating each redirect target. Consequently, a compromised or malicious task response could make the client request an attacker-selected URL. Depending on the protocols supported by the installed `curl`, this may include non-HTTPS resources, loopback addresses, private network services, or local resources. This is a client-side server-side request forgery–style issue, although retrieved content is written locally rather than automatically returned to the attacker. The filename is restricted to alphanumeric characters, periods, underscores, and hyphens, which prevents direct path traversal. However, the destination is opened with normal overwrite behavior. An API-controlled filename can therefore replace an existing file in the user-selected output directory. Different remote filenames may also ...[truncated 2007 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Permit only HTTPS downloads: ```bash curl --fail --show-error --proto '=https' --proto-redir '=https' ... ``` 2. Parse each URL and enforce an explicit allowlist of expected Manus CDN hostnames. Validate redirect destinations as well; do not assume that validating only the original URL is sufficient. 3. Reject loopback, link-local, private, and reserved network destinations if downloads are not restricted to a fixed CDN allowlist. 4. Prevent replacement of existing files. Create a unique destination with `mktemp`, download into it, validate it, and then atomically rename it to a non-existing final path. 5. Detect duplicate filenames after sanitization and generate unique names rather than silently overwriting a previous artifact. 6. Enforce maximum response sizes and reasonable connection and transfer timeouts, for example with `--max-filesize`, `--connect-timeout`, and `--max-time`. 7. Validate expected content type, file extension, and file signature before accepting a downloaded artifact. 8. Check every `curl`, `jq`, and filesystem operation for failure, and remove partial files when a download or validation step fails. ]]>