T06 · System Persistence
Error
- Location
- SKILL.md:18
- Finding
- Persistent Scheduled Execution Through an Insufficiently Secured Cron Job<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 18–29 **Vulnerability Type**: Persistent scheduled task using an unspecified and potentially mutable script path **Risk Level**: High ### Vulnerable Code ```markdown ## Auto-Check Node Health (Every 30 min) This skill automatically: 1. Check if current node is working 2. If failed, update subscription 3. Select a new working node ### Implementation Create a cron job: ``` */30 * * * * /path/to/check_v2rayn.sh ``` ``` ### Technical Analysis The instructions direct the user or agent to create a cron entry that executes `check_v2rayn.sh` every 30 minutes. This causes the script to continue executing across sessions and system use, creating persistent system state. Periodic health checking can be relevant to the declared functionality, but installing a persistent scheduled task is not the minimum privilege necessary to provide an on-demand status check. The instructions also do not specify: - A trusted, absolute location for the script. - Restrictive file and directory permissions. - Validation of script ownership. - An absolute interpreter path. - Integrity verification before each execution. - A cleanup or uninstallation procedure. The placeholder `/path/to/check_v2rayn.sh` may be replaced with a location writable by another local account, process, shared group, or synchronization mechanism. If the script or one of its parent directories is insufficiently protected, another party can replace or modify the script and obtain repeated code execution as the owner of the crontab. The scheduled script itself performs outbound HTTPS requests and reads the user's V2RayN configuration. Those operations are consistent with a health check, but their repeated unattended execution increases the consequences of later script compromise. ### Attack Path 1. The user follows the Skill instructions and creates the supplied cron entry. 2. The selected script path or one of its parent directories is w ...[truncated 1245 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Make the health check on-demand by default and require explicit, informed user consent before installing any recurring task. - Store the script in a fixed, user-owned directory rather than an arbitrary placeholder path. - Require restrictive permissions, for example: - Script permissions of `0700`. - Parent directories not writable by group members or other users. - Ownership matching the crontab owner. - Invoke a fixed interpreter and fixed script path, such as `/bin/bash "$HOME/.local/libexec/check_v2rayn.sh"`. - Configure a minimal `PATH` inside the script and use absolute paths for security-sensitive utilities where practical. - Verify the script's ownership and permissions before installation. - Avoid installing the task in a root or system crontab; the health check does not require administrative privileges. - Document how to inspect and remove the cron entry. - Consider a macOS `launchd` user agent only when recurring execution is explicitly requested, applying equivalent ownership and permission controls. - Ensure documentation accurately states that the supplied script only detects failure and notifies the user; it does not currently update subscriptions or select another node. ]]>