T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/music-search.sh:39
- Finding
- Arbitrary Local File Disclosure Through Bash Argument Expansion<![CDATA[ ## Vulnerability Details **File Location**: `scripts/music-search.sh:39-48` **Vulnerability Type**: Unrestricted local file read followed by external transmission **Risk Level**: High ### Vulnerable Code ```bash args=() if [ $# -gt 0 ]; then args=("$@") for i in "${!args[@]}"; do if [[ "${args[$i]}" == @* ]]; then filepath="${args[$i]:1}" if [ -f "$filepath" ]; then args[$i]="$(cat "$filepath")" fi fi done fi ``` ### Technical Analysis Every command-line argument beginning with `@` is interpreted as a local file path. There is no path allowlist, canonical-path validation, ownership check, or restriction to files created by the skill. The complete contents of a readable file replace the original argument. If this argument occupies the search keyword position, `music-search.js` incorporates the contents into queries passed to the external `web-search` skill. If that discovery mechanism fails, the query can also be submitted to Baidu through `deep_extract.py`. This crosses a least-privilege boundary because a music-search command does not legitimately require unrestricted access to arbitrary local files. The `@file` behavior is also not documented as a public user feature. ### Attack Path 1. An attacker, untrusted caller, or manipulated agent invokes the wrapper with an argument such as: ```bash bash scripts/music-search.sh search @/path/to/sensitive-file ``` 2. The wrapper removes the leading `@` and reads the entire file with `cat`. 3. The file contents replace the search keyword. 4. The JavaScript search engine embeds those contents in externally submitted search queries. 5. Sensitive values may consequently be disclosed to the web-search provider or Baidu and may also enter local cache files or diagnostic output. ### Impact Assessment The vulnerability permits disclosure of any file readable by the account running the skill. Depending on the execution environment, the exposed data could includ ...[truncated 361 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove public `@file` argument expansion and pass arguments literally. - If file-based query transport is required internally, expose it through a separate private interface rather than general CLI arguments. - Restrict readable files to a dedicated application-owned temporary directory. - Resolve the canonical path and verify that it remains under the permitted directory. - Verify file ownership, reject symbolic links, impose a small maximum file size, and delete temporary files after use. - Never submit file contents externally without explicit, informed user approval. - Add tests proving that paths such as `@/etc/passwd`, traversal paths, symlinks, and files outside the designated directory are rejected. ]]>