T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup-proxy.sh:6- Finding
Unvalidated Input Is Injected into Privileged Nginx Configuration
- Content
View full analysis
/dev/null << NGINX_EOF server { listen $PORT; server_name _; # 访问日志 access_log /var/log/nginx/openclaw-$USERNAME-access.log; error_log /var/log/nginx/openclaw-$USERNAME-error.log; location / { # 强制绑定 session 参数 return 302 http://\$host:$OPENCLAW_PORT/?session=$USERNAME&token=$TOKEN; } } NGINX_EOF ``` ### Technical Analysis The script copies the username, listening port, backend port, and token directly from arguments or the environment into a root-owned Nginx configuration. It performs no syntax, type, range, or control-character validation. Shell quoting does not protect the generated Nginx file. An input containing newline characters or Nginx syntax can terminate the intended directive and introduce additional directives. The bulk-creation script further allows usernames to originate from an external user-list file. The resulting configuration is written using `sudo tee`, tested using `sudo nginx -t`, and activated through an Nginx reload. A payload that remains syntactically valid can therefore become active with Nginx service privileges. ### Attack Path 1. An attacker supplies a crafted username through a user-list file or convinces an administrator to use crafted command-line arguments. 2. The administrator executes `create-users.sh` or `setup-proxy.sh` and approves the privileged operation. 3. The crafted value is inserted verbatim into log directives, the redirect directive, or other positions in the Nginx server block. 4. The script writes the injected configuration under `/etc/n ...[truncated 718 chars]- Remediation
View remediation