HIGH: Snapshot restore executes stored environment variables as shell commands #29

New issue

Closed

opened 2026-05-08 23:51:12 +00:00 by Mark · 3 comments

Mark commented

2026-05-08 23:51:12 +00:00

Owner

Issue

When restoring a snapshot, the stored env_vars (captured via env | sort) are written to .bashrc by executing shell commands inside the container. If the environment variables contain malicious content, they get executed.

Location

services/api/app/routes/snapshots.py:200-214

Current Implementation

if snapshot.env_vars:
    new_container.start()
    for line in snapshot.env_vars.split("\n"):
        if "=" in line:
            key, _, value = line.partition("=")
            safe_key = key.replace("'", "'\\''")
            safe_value = value.replace("'", "'\\''")
            new_container.exec_run(
                ["bash", "-lc", f"echo 'export {safe_key}=\"{safe_value}\"' >> ~/.bashrc"],
                workdir="/workspace",
            )

Note: env | sort output from the original container contains all environment variables, including any that were set with special characters. While the code attempts to escape single quotes, the value is embedded in a bash -lc command string, which can still be exploited.

Risk

If a session container's environment contains variables with shell metacharacters, they get executed during restore
Attackers who control a session can plant malicious env vars that execute on restore
The restore runs exec_run with root privileges inside the new container

Proposed Fix

Store env vars as structured JSON, not raw shell output
Write env vars to a config file using safer methods (e.g., writing to /etc/environment or using Docker's built-in env mechanism)
Parse the stored env vars more safely before reconstruction

Priority: High
Type: Security

## Issue When restoring a snapshot, the stored `env_vars` (captured via `env | sort`) are written to `.bashrc` by executing shell commands inside the container. If the environment variables contain malicious content, they get executed. ## Location - `services/api/app/routes/snapshots.py:200-214` ## Current Implementation ```python if snapshot.env_vars: new_container.start() for line in snapshot.env_vars.split("\n"): if "=" in line: key, _, value = line.partition("=") safe_key = key.replace("'", "'\\''") safe_value = value.replace("'", "'\\''") new_container.exec_run( ["bash", "-lc", f"echo 'export {safe_key}=\"{safe_value}\"' >> ~/.bashrc"], workdir="/workspace", ) ``` Note: `env | sort` output from the original container contains all environment variables, including any that were set with special characters. While the code attempts to escape single quotes, the value is embedded in a `bash -lc` command string, which can still be exploited. ## Risk - If a session container's environment contains variables with shell metacharacters, they get executed during restore - Attackers who control a session can plant malicious env vars that execute on restore - The restore runs `exec_run` with root privileges inside the new container ## Proposed Fix 1. Store env vars as structured JSON, not raw shell output 2. Write env vars to a config file using safer methods (e.g., writing to /etc/environment or using Docker's built-in env mechanism) 3. Parse the stored env vars more safely before reconstruction **Priority:** High **Type:** Security

Mark referenced this issue from a commit

2026-05-09 20:02:57 +00:00

fix(snapshots): #29 fix snapshot restore env var shell injection

Mark added the

blocked:needs-decision

label

2026-05-11 23:10:07 +00:00

Mark commented

2026-05-11 23:10:07 +00:00

Author

Owner

This is a security/design issue that needs human review before action.

Mark removed the

blocked:needs-decision

label

2026-05-11 23:11:33 +00:00

Mark commented

2026-05-11 23:11:33 +00:00

Author

Owner

Already fixed in commit 7d5ca55. Uses Docker API env mechanism instead of shell injection into .bashrc. JSON format for new snapshots with safe legacy fallback.

Already fixed in commit 7d5ca55. Uses Docker API env mechanism instead of shell injection into .bashrc. JSON format for new snapshots with safe legacy fallback.

Mark commented

2026-05-11 23:11:33 +00:00

Author

Owner

Fixed in commit. Closing.

Mark closed this issue

2026-05-11 23:11:34 +00:00

Mark referenced this issue from a commit

2026-05-23 17:54:21 +00:00

fix(snapshots): #29 fix snapshot restore env var shell injection

Mark referenced this issue from a commit

2026-05-23 17:54:21 +00:00