T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:35
- Finding
- Unsafe Cross-Domain IP Selection and Privileged Hosts-File Modification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 35-66 **Vulnerability Type**: Unsafe privileged system-file modification **Risk Level**: Medium ### Vulnerable Code ```powershell $hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts" $domains = @("github.com", "api.github.com", "objects.githubusercontent.com") # Resolve IPs $ips = @{} foreach ($domain in $domains) { $result = nslookup $domain 2>$null $ips[$domain] = ($result | Select-String -Pattern "Addresses:" -Context 0,10 | ForEach-Object { $_.Context.PostContext }) -replace '\s+', '' | Where-Object { $_ -match '^\d+\.\d+\.\d+\.\d+$' } } # Ping each IP and find fastest $results = @() foreach ($ip in ($ips.Values | Select-Object -Unique)) { $avg = (ping -n 3 $ip | Select-String -Pattern "平均").ToString() -replace '.*= (\d+)ms.*', '$1' if ($avg) { $results += [PSCustomObject]@{ IP = $ip; Avg = [int]$avg } } } $fastest = ($results | Sort-Object Avg | Select-Object -First 1).IP # Update hosts $entry = "$fastest github.com`n$fastest api.github.com" $current = Get-Content $hostsPath -Raw -ErrorAction SilentlyContinue if ($current -notmatch "github\.com") { Add-Content -Path $hostsPath -Value $entry } else { $updated = $current -replace "[\d\.]+\s+github\.com`n?[\d\.]+\s+api\.github\.com", $entry Set-Content -Path $hostsPath -Value $updated } # Flush DNS ipconfig /flushdns | Out-Null Write-Host "Done! Fastest IP: $fastest" ``` ### Technical Analysis The script combines all IPv4 addresses resolved for `github.com`, `api.github.com`, and `objects.githubusercontent.com` into one candidate pool. It then selects a single address based only on ping latency and assigns that address to both `github.com` and `api.github.com`. This process does not verify that the selected address is valid for each hostname being mapped. An address returned for `objects.githubusercontent.com`, for example, can be selected and assigned to the two unrelated hostnames. Latency alon ...[truncated 2893 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Preserve a separate candidate list for each hostname and select an address independently for each domain. 2. Abort without modifying the hosts file if any resolution, validation, or latency test fails. 3. Validate each candidate by establishing an HTTPS connection using the intended hostname and normal certificate verification, rather than relying only on ping latency. 4. Replace locale-dependent parsing of `ping` output with locale-independent PowerShell networking APIs. 5. Display the exact proposed old and new mappings and obtain explicit user confirmation before requesting elevation or writing the file. 6. Back up the hosts file before modification and provide an automated rollback command. 7. Manage entries inside explicit marker comments so only entries owned by this skill are modified. 8. Preserve unrelated entries, comments, encoding, and line endings. 9. Write changes to a temporary file, validate the result, and then use an atomic replacement operation. 10. Do not write an empty or null IP address under any circumstances. 11. Either add and validate a domain-specific entry for `objects.githubusercontent.com` or remove it from the resolution list. 12. Prefer normal DNS and CDN routing unless there is a well-justified operational need for static hosts entries. ]]>