T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:68- Finding
Shell Command Injection Through an Unquoted Configuration Path
- Content
View full analysis
/dev/null 2>&1`); logSuccess('JSON format is valid'); return true; } catch (error) { logError('JSON format is invalid'); return false; } } ``` `CONFIG_PATH` is constructed from the current user's home directory: ```js const CONFIG_PATH = path.join(require('os').homedir(), '.openclaw/openclaw.json'); ``` ### Technical Analysis The configuration path is interpolated directly into a command interpreted by a shell. It is not quoted or passed as a discrete process argument. If the home-directory value contains shell metacharacters or command substitutions, the shell can interpret those characters rather than treating the entire value as a file path. This execution occurs when `validateJSON()` is reached through `--check` or `--debug`. Shell execution is unnecessary because `readConfig()` has already parsed the same file with `JSON.parse`. Exploitation requires an attacker to influence the home-directory value used by the Node.js process and ensure that `readConfig()` can read a valid configuration from the resulting literal path. This limits practical exploitability but does not eliminate the command-injection primitive. ### Attack Path 1. An attacker influences the home-directory environment or account metadata used by `os.homedir()`. 2. The resulting home path contains shell syntax or command substitution. 3. A valid `openclaw.json` is placed at the literal path so that `readConfig()` succeeds. 4. The user invokes the Skill with `--check` or `--debug`. 5. `validateJSON()` interpolates the path into `execSync()`. 6. The shell evaluates the attacker-controlled syntax and executes the injected command. ### Impact Assessment Successful exploitation permits arbitrary command execution ...[truncated 271 chars]- Remediation
View remediation