T09 · Insecure Skill Coding Practices
Error
- Location
- saas-landing-page.sh:54
- Finding
- Output Path Traversal Through Unsanitized Product and Output Values<![CDATA[ ## Vulnerability Details **File Location**: `saas-landing-page.sh`, lines 54–60 **Vulnerability Type**: Path traversal and unintended file overwrite **Risk Level**: High ### Vulnerable Code ```bash # Create output directory DIR_NAME=$(echo "$PRODUCT" | tr '[:upper:]' '[:lower:]' | tr ' ' '-') OUTPUT_PATH="$OUTPUT_DIR/$DIR_NAME-landing" mkdir -p "$OUTPUT_PATH/components" mkdir -p "$OUTPUT_PATH/assets" ``` ### Technical Analysis The product name is converted to lowercase and spaces are replaced with hyphens, but path separators and traversal sequences such as `../` are preserved. `OUTPUT_DIR` is also accepted without validation or canonical containment checks. Although the variables are quoted, quoting only prevents shell word splitting and wildcard expansion. It does not prevent filesystem path traversal. The resulting path is subsequently used by multiple truncating redirections that create or replace `App.jsx`, `index.html`, `README.md`, and component files. This vulnerability becomes directly exploitable when product names or output options originate from an untrusted user, automated request, document, or agent-generated input. ### Attack Path 1. An attacker supplies a product name containing traversal components, such as `../../target`. 2. The transformations performed by `tr` leave the `../` components intact. 3. The script constructs a path such as `./../../target-landing`. 4. `mkdir -p` resolves that path outside the intended output directory. 5. Subsequent heredoc redirections create or truncate fixed-name files in that external directory. 6. The files are written with the privileges of the account running the generator. ### Impact Assessment An attacker can cause files to be created outside the intended generation directory. If a matching target directory already exists, fixed-name files such as `index.html`, `App.jsx`, or `README.md` may be overwritten. The vulnerability does not independently elevate privileges. Its scope is limi ...[truncated 208 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Convert the product name into a strict slug using an allowlist such as lowercase ASCII letters, digits, and hyphens. - Reject empty slugs, `.` and `..`, path separators, control characters, and absolute paths. - Restrict output generation to a configured base directory. - Canonicalize both the base directory and final destination, then verify that the destination remains beneath the approved base. - Refuse to write into an existing directory unless the user explicitly authorizes replacement. - Use restrictive permissions and run the generator under a least-privileged account. Example hardening approach: ```bash BASE_DIR=$(realpath -m "${OUTPUT_DIR:-.}") DIR_NAME=$(printf '%s' "$PRODUCT" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]/-/g; s/-\{2,\}/-/g; s/^-//; s/-$//') [ -n "$DIR_NAME" ] || { echo "Invalid product name" >&2 exit 1 } OUTPUT_PATH=$(realpath -m "$BASE_DIR/${DIR_NAME}-landing") case "$OUTPUT_PATH/" in "$BASE_DIR/"*) ;; *) echo "Output path escapes the approved directory" >&2 exit 1 ;; esac ``` ]]>