Security Vulnerability Audit Report

Executive Summary

The ScorpioX codebase is a substantial C project comprising a TUI client, HTTP/WebSocket server, DNS server, SMTP/IMAP email subsystem, container engine, and multiple utility programs. The codebase demonstrates generally sound security practices — no classic strcpy/strcat/sprintf/gets calls were found in project-owned code, and snprintf is used consistently (2,282 instances). However, significant risks exist in command injection via system()/popen() (118+ call sites), large stack-allocated buffers, and several areas lacking bounds/null checks.

Vulnerability Summary

Detailed Analysis

1. Buffer Overflow Analysis

1.1 Unsafe String Functions — PASS ✅

The codebase demonstrates excellent discipline in avoiding classic unsafe functions:

1.2 Stack Buffer Risks — MEDIUM RISK ⚠️

1.3 sscanf Width Limits — LOW RISK

28 sscanf/fscanf calls were found. Most use width specifiers:

• sscanf(line, "%47s %255s", commit, ref) — ✅ Width-limited
• sscanf(ent->d_name, "%4d_%2d_%2d_", ...) — ✅ Width-limited
• fscanf(pf, "%d", &pid) — ✅ Integer scan, no overflow risk
• sscanf(line, "%255s %15s %63s %63s %63s", ...) — ✅ All width-limited

No unbounded %s scans were found.

2. Format String Analysis — PASS ✅

No format string vulnerabilities were identified:

• All printf() family calls use string literal format specifiers
• SX_LOG macros use __VA_ARGS__ pattern with proper format strings
• No printf(variable) patterns found (only one printf(ANSI_CLEAR ...) with compile-time constant)
• vfprintf(stderr, fmt, ap) in ws2tcp.c:logmsg() receives format from code-controlled fmt parameter

3. Integer Overflow Analysis — LOW-MEDIUM RISK ⚠️

3.1 Allocation Arithmetic

3.2 Realloc Growth Patterns

Most realloc uses a doubling pattern (cap * 2). While size_t overflow is theoretically possible, practical exploitation requires near-maximum allocations.

4. Memory Safety Analysis

4.1 Allocation Summary

4.2 Unsafe realloc Patterns — MEDIUM RISK (V-10, V-16)

Several realloc() calls lose the original pointer on failure:

// scorpiox-vi.c:191 — Original pointer lost on failure
E.out_buf = realloc(E.out_buf, E.out_cap);
if (!E.out_buf) return;  // Memory leak: old buffer not freed

// scorpiox-vi.c:424
line->data = realloc(line->data, line->cap);
if (!line->data) return;  // Memory leak + data loss

// scorpiox-openai.c:73
b->data = realloc(b->data, b->cap);  // No NULL check at all

char *tmp = realloc(buf, newcap);
if (!tmp) { / handle error, buf still valid / }
buf = tmp;

4.3 Double-Free / Use-After-Free — NO ISSUES FOUND ✅

All free() calls are followed by NULL assignment or are in cleanup paths. No double-free patterns detected.

4.4 strdup Without NULL Check

409 strdup() calls exist. While most are used in non-critical paths, some should be audited for NULL handling in memory-constrained environments (e.g., WASM builds).

5. Command Injection Analysis — CRITICAL 🔴

This is the highest-risk category in the codebase. 118+ system() calls and 40+ popen() calls were identified.

5.1 V-01: CGI Environment Variable Injection (CRITICAL)

On Windows, CGI environment variables (from HTTP headers) are embedded into a cmd /C command string:

pos += snprintf(cmd + pos, cmd_size - pos, "set \"%s=%s\" && ", env_name, safe_val);

The SX_SANITIZE_CMD macro only strips: " & | ^ < >. This misses:

• Newline characters (\n, \r) — can break out of set command
• Backtick (` `) — command substitution in some shells
• % — Windows environment variable expansion (%PATH%)
• ! — delayed expansion in cmd.exe

snprintf(cmd, sizeof(cmd),
    "scorpiox-fetch \"%s\" -f html --user-agent \"%s\" 2>/dev/null", url, USER_AGENT);
FILE *fp = popen(cmd, "r");

If url contains shell metacharacters (e.g., "; rm -rf /; #), they will be interpreted by /bin/sh. The double-quote wrapping is insufficient — a " in the URL breaks out.

snprintf(wcmd, sizeof(wcmd), "which %s >/dev/null 2>&1", tok);
if (system(wcmd) != 0) { all_present = 0; break; }

Multiple system() calls construct commands from name (distro name) and command parameters without shell escaping:

snprintf(cmd, sizeof(cmd), "wsl.exe -d %s -- %s /bin/bash -l", name, ep);
return system(cmd);

system(cmd);        // Line 620 - bridge launch
system(tmux_cmd);   // Line 831 - tmux command from message data

The snprintf → system() pattern is used pervasively across:

• sxtmux_backend_tmux.c (5 system calls)
• sxtmux_backend_sxmux.c (3 system calls)
• scorpiox-vault-git.c (2 system calls)
• scorpiox-unshare.c (15+ system calls)
• scorpiox-vm.c (2 system calls)
• sx.c (8 system calls)

if (strstr(url_path, "..")) {
    // blocked
}

• URL-encoded traversal (%2e%2e/etc/passwd) bypasses it
• The path has already gone through parse_http_request() but URL decoding is NOT applied to the path
• However, raw .. in HTTP request paths is caught

• sx_dll.c: Worker thread with mutex+condvar (properly synchronized)
• sx_cache_keepalive.c: Background keepalive thread (properly synchronized)
• scorpiox-server.c: Git poll thread (uses pthread_sigmask correctly)

36 signal handler registrations found. Most use signal() rather than sigaction():

signal(SIGINT, handle_signal);   // Non-portable, can reset to SIG_DFL
signal(SIGTERM, handle_signal);
signal(SIGCHLD, reap_children);  // Race between signal delivery and wait()

• signal() has undefined behavior regarding handler reset on some platforms
• reap_children in scorpiox-server.c may have SIGCHLD race with popen()/pclose() — though the code explicitly blocks SIGCHLD during popen() calls (good)

• V-12: access() → realpath() → execute in scorpiox-server.c — low-probability race
• scorpiox-unshare.c: Multiple access() checks before system() — but operates in controlled container context

Compilation with -Wall -Wextra -Wformat-security -Wformat=2 produced:

• malloc() return values are checked in ~95% of cases ✅
• fopen() returns are consistently checked ✅
• getenv() returns appear to be used safely (checked or with defaults)
• strdup() returns are occasionally unchecked ⚠️

   char *argv[] = {"scorpiox-fetch", url, "-f", "html", "--user-agent", USER_AGENT, NULL};
   // Use fork()/execvp() with pipe for output capture
   

   int sx_exec_argv(const char prog, char const argv[], char **output);
   

   void *tmp = realloc(ptr, newsize);
   if (!tmp) { / error handling / }
   ptr = tmp;