T09 · Insecure Skill Coding Practices
Error
- Location
server.js:173- Finding
Shell Command Injection in Agent Chat and Deletion Endpoints
- Content
View full analysis
{ exec(cmd, { shell: 'zsh' }, (error, stdout, stderr) => { if (error) reject(error); else resolve({ stdout, stderr }); }); }); } ``` ```javascript const agentId = id.replace('agent-', ''); const workspace = agentConfig?.workspace || `workspace-${agentId}`; const workspacePath = path.join(CONFIG.workspaceDir, workspace); // Check whether the workspace exists try { await fs.access(workspacePath); } catch (e) { return res.status(404).json({ success: false, error: `Agent 工作区不存在：${workspacePath}` }); } const safeMessage = message.replace(/"/g, '\\"').replace(/\n/g, ' '); const { stdout } = await execCmd( `cd "${workspacePath}" && openclaw agent --agent ${agentId} --message "${safeMessage}" --json 2>&1` ); ``` ```javascript app.delete('/api/agents/:id', async (req, res) => { try { const { id } = req.params; const agentDir = path.join(CONFIG.agentsDir, id); try { await fs.access(agentDir); } catch (e) { return res.status(404).json({ success: false, error: 'Agent 不存在' }); } await execCmd(`rm -rf "${agentDir}"`); ``` ### Technical Analysis The application constructs Zsh command strings containing request-controlled Agent IDs, workspace values, and chat messages. Replacing double quotes and newlines is not valid shell escaping. Shell expressions such as command substitution remain active inside double quotes, while `agentId` is inserted without shell quoting. The deletion endpoint similarly passes a request-derived path to `rm -rf` through a shell. Path ...[truncated 1171 chars]- Remediation
View remediation