🛡️ Sentinel: [CRITICAL] Fix arbitrary binary execution via config paths#38
🛡️ Sentinel: [CRITICAL] Fix arbitrary binary execution via config paths#38bitcoiner-dev wants to merge 1 commit into
Conversation
The `run_bitcoin_cli` function previously took the `bitcoin_cli` path straight from user config and ran it via `Command::new`. While this prevented shell argument injection, it allowed arbitrary executables (e.g., `/bin/sh`) to be run if configured maliciously. This change adds `validate_bitcoin_cli_path` to strictly check that the executable filename is exactly `bitcoin-cli` or `bitcoin-cli.exe` and that no directory traversal (`..`) is used. Co-authored-by: bitcoiner-dev <75873427+bitcoiner-dev@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🚨 Severity: CRITICAL
💡 Vulnerability: Arbitrary binary execution via user-provided configuration path (
bitcoin_cli). Even thoughCommand::newmitigates argument injection, passing an unsanitized path like/bin/shor a script from a traversed directory allowed a malicious config to execute arbitrary binaries.🎯 Impact: If an attacker can control or modify the
config.jsonor user profile (which are in plaintext by default when not locked), they could gain arbitrary code execution when the user attempts any network operation requiringbitcoin-cli.🔧 Fix: Introduced
validate_bitcoin_cli_pathto strictly validate the user-supplied binary path. It verifies the final path segment is strictlybitcoin-cliorbitcoin-cli.exeand rejects paths containing directory traversal (..).✅ Verification: Verified by unit tests added to
src/utils.rsdemonstrating valid path parsing and rejection of insecure paths like/bin/shand relative paths.PR created automatically by Jules for task 14960547950205321131 started by @bitcoiner-dev