T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/twenty-config.sh:11
- Finding
- Arbitrary Shell Execution Through Unsafe Configuration Loading## Vulnerability Details **File Location**: `scripts/twenty-config.sh:11, 29-31` **Vulnerability Type**: Executable configuration file / arbitrary shell command execution **Risk Level**: Medium ### Vulnerable Code ```bash CONFIG_FILE="${TWENTY_CONFIG_FILE:-$DEFAULT_CONFIG_FILE}" if [ -f "$CONFIG_FILE" ]; then # shellcheck disable=SC1090 source "$CONFIG_FILE" fi ``` ### Technical Analysis The script treats `config/twenty.env` as a data-based environment file but loads it with Bash's `source` built-in. Sourcing a file executes its entire contents in the current shell rather than parsing only environment-variable assignments. Consequently, a configuration file can contain arbitrary shell commands, command substitutions, functions, redirections, or other Bash syntax. The `TWENTY_CONFIG_FILE` environment variable also allows the caller to select any readable file as the configuration source. This becomes exploitable when an attacker can modify the default configuration file, influence `TWENTY_CONFIG_FILE`, or otherwise cause a malicious file to be loaded. The injected commands execute with the same operating-system privileges and environment as the invoked CRM helper. ### Attack Path 1. An attacker gains control over `config/twenty.env` or influences the process environment to set `TWENTY_CONFIG_FILE` to an attacker-controlled readable file. 2. The attacker places shell commands in that file, potentially alongside valid `TWENTY_BASE_URL` and `TWENTY_API_KEY` assignments. 3. A user or agent invokes any helper that sources `twenty-config.sh`. 4. `twenty-config.sh` executes `source "$CONFIG_FILE"`. 5. The attacker's commands run before the intended CRM API request and inherit the helper's privileges and environment. ### Impact Assessment Successful exploitation permits arbitrary command execution under the account running the Skill. The attacker could read files available to that account, access the configured Twenty CRM API key, alter local data, or mak ...[truncated 327 chars]
- Remediation
- ## Remediation Suggestions Replace `source` with a non-executing configuration parser: 1. Accept only an explicit allowlist of keys, namely `TWENTY_BASE_URL` and `TWENTY_API_KEY`. 2. Parse assignment lines as data without `eval`, `source`, or shell expansion. 3. Reject command substitutions, shell operators, functions, redirections, unrecognized keys, and malformed lines. 4. Prefer direct environment-variable configuration or a structured format parsed by a safe standard parser. 5. If `TWENTY_CONFIG_FILE` remains supported, resolve and validate the path and ensure that the file is a regular file owned by the expected user. 6. Reject configuration files writable by group or other users and recommend mode `0600`. 7. Avoid exporting the API key unless child processes genuinely require it; pass secrets only to the specific command that needs them.