T09 · Insecure Skill Coding Practices
Error
- Location
scripts/report_generator.py:238- Finding
Undocumented Arbitrary Python Script Execution Through Schedule Configuration
- Content
View full analysis
Dict: """Execute a custom script report. params: script, args(list) """ import subprocess params = job.get("params", {}) script = params["script"] if not os.path.isabs(script): script = os.path.join(SCRIPT_DIR, script) cmd = [sys.executable, script] + params.get("args", []) result = subprocess.run(cmd, capture_output=True, text=True, timeout=300) return { "type": "custom", "script": script, "returncode": result.returncode, "stdout": result.stdout[-2000:] if result.stdout else "", "stderr": result.stderr[-1000:] if result.stderr else "", } REPORT_RUNNERS = { "audit": run_audit_report, "template": run_template_report, "custom": run_custom_report, } ``` ### Technical Analysis The report scheduler accepts a user-supplied YAML schedule and dispatches jobs according to their `type`. Registering `custom` in `REPORT_RUNNERS` allows a schedule to specify an arbitrary Python file in `params.script`. Absolute paths are accepted without restriction. Relative paths are joined to the script directory but are not normalized or checked for traversal, so values containing `../` can also resolve outside the intended directory. There is no script allowlist, trusted-directory restriction, ownership or permission validation, signature verification, explicit confirmation, or environment isolation. Although `subprocess.run()` uses an argument list rather than a shell and therefore avoids conventional shell metacharacter injection, it still deliberately executes the selected file as Python code. The process inherits the scheduler's user privileges, working environment, and sensitive environment variables, including ...[truncated 2006 chars]- Remediation
View remediation