T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/predict.sh:16- Finding
Unrestricted Local File Upload to an External Service
- Content
View full analysis
&2 exit 1 fi # 3. Check for API key if [ -z "${GEOINFER_API_KEY:-}" ]; then echo "Error: GEOINFER_API_KEY is required. Set it with: export GEOINFER_API_KEY=\"your_key\"" >&2 exit 1 fi # 4. Validate top_n range if [ "$TOP_N" -lt 1 ] || [ "$TOP_N" -gt 15 ] 2>/dev/null; then echo "Error: top_n must be between 1 and 15." >&2 exit 1 fi # 5. Run prediction curl -s -X POST "https://api.geoinfer.com/v1/prediction/predict?model_id=${MODEL_ID}&top_n=${TOP_N}" \ -H "X-GeoInfer-Key: $GEOINFER_API_KEY" \ -F "file=@${IMAGE_PATH}" ``` ### Technical Analysis The script only checks whether the supplied path resolves to a regular file using `-f`. It does not verify that the file is an image, inspect its actual MIME type or file signature, enforce the documented 10 MB limit, restrict access to an approved input directory, or reject symbolic links where appropriate. Consequently, any readable regular file can be submitted to the external GeoInfer API. This behavior exceeds the minimum file-access privileges necessary for image geolocation. Extension-only validation would not be sufficient because a sensitive file can be renamed; validation should use both size limits and content-derived file types. The external transmission itself is part of the declared functionality when the selected file is a legitimate image. The vulnerability is that the implementation does not constrain which local files can be transmitted. ### Attack Path 1. An attacker, untrusted prompt, or other untrusted input influences the `IMAGE_PATH` argument. 2. The attacker supplies a path to a readable sensitive file, or a symbolic link resolving to one. 3. ...[truncated 829 chars]- Remediation
View remediation