T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/route_whatsapp.sh:4
- Finding
- Arbitrary Local File Upload to a Configurable Destination## Vulnerability Details **File Location**: `scripts/route_whatsapp.sh`, lines 4–47 **Vulnerability Type**: Unrestricted local file upload and potential data exfiltration **Risk Level**: High ### Vulnerable Code ```bash BASE_URL="${BASE_URL:-http://localhost:8080}" ``` ```bash decode) if [[ -z "$ARG" ]]; then echo '{"error":"missing image path argument for decode mode"}' exit 2 fi if [[ ! -f "$ARG" ]]; then printf '{"error":"image file not found: %s"}\n' "$ARG" exit 2 fi curl --silent --show-error --max-time "$TIMEOUT" \ -X POST "$BASE_URL/decode-qr" \ -F "image=@$ARG" ;; ``` ### Technical Analysis Decode mode accepts an arbitrary local path through `ARG`. The only validation is `[[ -f "$ARG" ]]`, which confirms that the supplied path refers to a regular file. The script does not require the file to reside in an approved WhatsApp attachment directory, validate that it is an image, enforce an allowed file extension or MIME type, restrict symbolic-link resolution, or impose a file-size limit. Curl's multipart syntax, `-F "image=@$ARG"`, causes curl to read the referenced local file and transmit its contents. Therefore, any readable regular file available to the script's operating-system account can be submitted instead of a QR image. The upload destination is also configurable through the inherited `BASE_URL` environment variable. Although the default destination is loopback-only, a caller capable of controlling the execution environment can redirect the upload to an external HTTP endpoint. The combination creates a local-file disclosure and potential data-exfiltration primitive. ### Attack Path 1. An attacker influences the decode argument directly or induces the agent to treat an attacker-selected local path as an image attachment. 2. The attacker supplies a readable sensitive path, for example an application configuration or credential file. 3. The `-f` che ...[truncated 1243 chars]
- Remediation
- ## Remediation Suggestions 1. Resolve the supplied path to its canonical absolute path and require it to remain inside a dedicated, trusted WhatsApp attachment directory. 2. Reject symbolic links or verify the canonical target after link resolution to prevent path-boundary bypasses. 3. Validate the file using an allowlist of supported image MIME types and verify its actual file signature rather than relying only on its extension. 4. Enforce conservative file-size and image-dimension limits before upload. 5. Do not inherit an unrestricted `BASE_URL`. Prefer a fixed loopback endpoint, or parse and allowlist the exact scheme, host, port, and route. 6. Reject credentials, query strings, redirects, non-HTTP schemes, and non-loopback destinations. Consider using curl's `--proto`, `--proto-redir`, and `--max-redirs 0` restrictions. 7. Run the script under a dedicated least-privileged account that cannot read application secrets or unrelated user files. 8. Pass attachment metadata through a trusted interface rather than accepting an arbitrary filesystem path from user-controlled content.