T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/create_account.sh:7- Finding
Executable API Client Is Sourced, Enabling Unintended Privileged API Dispatch
- Content
View full analysis
/dev/null || true HOST="${CPANEL_HOST:?CPANEL_HOST not set}" TOKEN="${CPANEL_TOKEN:?CPANEL_TOKEN not set}" ``` ```bash # scripts/cpanel_api.sh:28-59 API_TYPE="${1:-whm}" ENDPOINT="${2}" shift 2 2>/dev/null || true PARAMS="$@" # Build URL and auth header case "$API_TYPE" in whm) URL="${HOST}/json-api/${ENDPOINT}" AUTH_HEADER="Authorization: whm ${TOKEN}" ;; uapi) URL="${HOST}/execute/${ENDPOINT}" AUTH_HEADER="Authorization: cpanel ${TOKEN}" ;; cpanel2) URL="${HOST}/json-api/cpanel2" AUTH_HEADER="Authorization: cpanel ${TOKEN}" ;; *) echo "Error: Invalid API type. Use: whm, uapi, or cpanel2" exit 1 ;; esac # Append params if [[ -n "$PARAMS" ]]; then URL="${URL}?${PARAMS}" fi # Make request RESPONSE=$(curl -s -w "\n%{http_code}" -H "$AUTH_HEADER" "$URL") ``` ### Technical Analysis `cpanel_api.sh` is a complete executable program with top-level argument parsing, control flow, network activity, and `exit` calls. It is not a source-only configuration library. When `create_account.sh` sources it, the sourced program inherits the positional arguments originally supplied to `create_account.sh`. Consequently, the intended account username becomes `API_TYPE`, the domain becomes `ENDPOINT`, and the password and plan become raw query-string parameters. Normal usernames usually make the sourced script terminate with an invalid API-type error. More importantly, arguments beginning wit ...[truncated 1289 chars]- Remediation
View remediation