T09 · Insecure Skill Coding Practices
Warning
- Location
- generate.sh:15
- Finding
- Unrestricted Target Directory Allows Overwriting Existing Project Files<![CDATA[ ## Vulnerability Details **File Location**: `generate.sh:10,15-16` **Vulnerability Type**: Unvalidated filesystem destination and unsafe file overwrite **Risk Level**: Medium ### Vulnerable Code ```bash NAME="${1:-my-app}" FRONTEND="${2:-react}" BACKEND="${3:-node}" DB="${4:-postgresql}" echo "🚀 Generating fullstack app: $NAME" echo "📦 Frontend: $FRONTEND | Backend: $BACKEND | DB: $DB" # Create directory mkdir -p "$NAME" cd "$NAME" ``` The script subsequently uses truncating output redirections to write predictable files under the selected destination, including: ```bash cat > frontend/package.json << EOF ``` ```bash cat > backend/package.json << EOF ``` ```bash cat > docker-compose.yml << EOF ``` ### Technical Analysis The first argument is accepted as a filesystem path without checking whether it is: - An absolute path. - A path containing traversal components such as `../`. - An existing or non-empty directory. - Located outside an approved generation directory. Although quoting prevents shell word splitting, it does not constrain where the script writes. `mkdir -p` accepts existing directories, after which `cd "$NAME"` makes the attacker-selected directory the base for all generated files. The `cat > file` operations truncate existing files without confirmation. The vulnerability is therefore an arbitrary destination write within the permissions of the user running the generator. It is not arbitrary-content file writing, because the generated contents are largely fixed, but it can destructively replace predictable project files. ### Attack Path 1. An attacker influences the first argument supplied to `generate.sh`. 2. The attacker selects an existing writable directory, such as an unrelated application directory, using an absolute or traversal path. 3. `mkdir -p` succeeds because the directory already exists. 4. The script changes into that directory. 5. Existing files such as `frontend/package.json`, `backend/package.json`, `bac ...[truncated 715 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require the application name to be a safe basename rather than an arbitrary path: ```bash NAME="${1:-my-app}" if [[ ! "$NAME" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then echo "Invalid application name" >&2 exit 1 fi ``` 2. Generate applications beneath a fixed, explicitly selected base directory and verify the resulting path remains inside it. 3. Reject absolute paths, `.` and `..` path components, path separators, and empty names. 4. Refuse to use an existing non-empty destination unless an explicit, clearly documented overwrite option is supplied. 5. Before each redirection, verify that the destination does not already exist and is not a symbolic link. 6. Run the generator with the least-privileged account required for the task. ]]>