T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:78- Finding
Path Traversal Through Unvalidated Event Source
- Content
View full analysis
> "$log_file" ``` ### Technical Analysis The workflow accepts `SOURCE` from the first positional argument and directly incorporates it into `LOG_DIR` without validation or canonicalization. Although shell quoting prevents direct command injection, it does not prevent filesystem traversal sequences such as `../`. Consequently, a source such as `../../tmp/attacker-controlled` causes the effective logging directory to escape `/var/log/pilot-events`. The script then creates that directory and repeatedly appends event data to `current.ndjson`. Existing symbolic links in the selected path could also redirect writes beyond the intended logging directory. The exposed write is constrained to a file named `current.ndjson` beneath the attacker-selected directory. Its practical reach depends on the filesystem privileges of the account executing the workflow. ### Attack Path 1. An attacker or untrusted caller supplies a crafted first argument containing traversal components, for example: ```bash ./event-log.sh ../../tmp/external-log ``` 2. The script constructs: ```text /var/log/pilot-events/../../tmp/external-log ``` 3. `mkdir -p` resolves the traversal and creates a directory outside the intended logging root if permissions allow. 4. The event subscription begins, and each received event is appended to: ```text /tmp/external-log/current.ndjson ``` 5. Alternatively, an attacker who can prepare f ...[truncated 1184 chars]- Remediation
View remediation
&2 exit 1 ;; esac ``` 2. Canonicalize the logging root and destination, then verify that the destination remains beneath the expected root: ```bash LOG_ROOT="/var/log/pilot-events" mkdir -p -- "$LOG_ROOT" root_real=$(realpath -- "$LOG_ROOT") LOG_DIR="$LOG_ROOT/$SOURCE" mkdir -p -- "$LOG_DIR" dir_real=$(realpath -- "$LOG_DIR") case "$dir_real/" in "$root_real"/*) ;; *) printf 'Logging destination escapes the permitted root\n' >&2 exit 1 ;; esac ``` 3. Reject symbolic-link destinations. Open the log through a mechanism that does not follow symbolic links where possible, and verify ownership and file type before appending. 4. Run the logger as a dedicated, unprivileged service account whose write permissions are restricted to the logging root. 5. Set restrictive permissions explicitly: ```bash umask 077 mkdir -p -m 0700 -- "$LOG_DIR" ``` 6. Apply storage quotas and monitoring to prevent redirected or unexpectedly high-volume logging from exhausting disk capacity. ]]>