T09 · Insecure Skill Coding Practices
Error
- Location
chrome-extension-generator.sh:45- Finding
Output Directory Traversal and Arbitrary File Overwrite in Chrome Extension Generator
- Content
View full analysis
"$OUTPUT_PATH/manifest.json" << MANIFEST { "manifest_version": 3, "name": "$NAME", "version": "1.0.0", "description": "$DESCRIPTION", "permissions": ["storage"], "action": { "default_popup": "popup.html", "default_icon": "icon.png" }, "background": { "service_worker": "background.js" }, "icons": { "16": "icon.png", "48": "icon.png", "128": "icon.png" } } MANIFEST ``` The same attacker-controlled `OUTPUT_PATH` is subsequently used to write `popup.html`, `popup.js`, `background.js`, and `README.md`. ### Technical Analysis The extension name is converted to lowercase and spaces are replaced with hyphens, but path separators and `..` components are not removed. The optional output directory is also accepted without canonicalization or containment validation. Consequently, a name such as `../../target` produces a path outside the intended output directory. Shell quoting prevents word splitting, but it does not prevent the operating system from resolving traversal components. The `cat > file` redirections overwrite existing files without confirmation. ### Attack Path 1. An attacker supplies or influences the extension name or output directory. 2. The extension name contains traversal components such as `../../target`. 3. The script constructs `OUTPUT_PATH` using the unvalidated value. 4. The operating system resolves the traversal outside the intended generation root. 5. The script creates directories and overwrites predictable files such as `manifest.json`, `popup.html`, `background.js`, and `README.md`. 6. A later process ...[truncated 558 chars]- Remediation
View remediation