# Config Fields Reaching Command Sinks

User-editable config fields (version, path, driver, class) reaching shell, download, library load, or a validator skipped on one write path

_Area: Web infrastructure and server-side requests. Seen in 9 disclosed reports; 3 confirmed bounties, median $520, range $480-$2,480; latest 2026-10-15. Updated 2026-10-23._

## How it works
A configuration field is treated as inert data but consumed as code. The broken assumption: version strings, paths, driver/class names, and directives are just values. In practice they get interpolated into a download URL, a command line, a native library path, or a config file that a daemon later parses, so whoever can edit that field controls what is fetched, loaded, or executed. Two trust boundaries are missing: between "who may edit config" and "what runs on the host," and between the validator's idea of the input and the consumer's actual parser.

## Where it shows up
- Connection/extra fields named version, path, driver, class, or binary_path feeding a URL or exec call [E3](https://bugbountylibrary.com/r/h1%3A1895316.md)[E8](https://bugbountylibrary.com/r/h1%3A2065288.md)
- Native library or class loading from a user-supplied path (JDBC jar, dlopen) [E8](https://bugbountylibrary.com/r/h1%3A2065288.md)
- Downloaded binaries fetched and executed without integrity check [E3](https://bugbountylibrary.com/r/h1%3A1895316.md)
- Generated commands passed to another tool whose own argument semantics (e.g. leading @ = file read) are not accounted for [E4](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-the-curl-quirk-that-exposed-burp-suite-amp-google-chrome.md)
- A directive denylist that inspects only the first token per line, while the target parser splits on `;` [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-cf23-7qxj-xmhr.md)
- The same privileged write exposed over several interfaces (REST, MCP, CLI) where only some call the validator [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-76pm-mq2q-9gcr.md)[E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-9jww-cxg5-rj9m.md)[E7](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r62-gj48-897x.md)
- Static blacklists of dangerous flags as the only guard (adjacent) [E1](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2018-05-24-electron-win-protocol-handler-bug-bypass-html.md)

## How to review
Trace every user-editable config field to its sink. Invariant: no config value reaches a shell, exec, download URL, library load, or a config file the daemon parses without allowlisting or escaping that matches the consumer's parser. Checklist:
- Version/path fields: validated against a fixed set, not free text? [E3](https://bugbountylibrary.com/r/h1%3A1895316.md)
- Download URLs built from constants, not interpolation? [E3](https://bugbountylibrary.com/r/h1%3A1895316.md)
- Driver/class paths restricted to known locations? [E8](https://bugbountylibrary.com/r/h1%3A2065288.md)
- Does the target tool reinterpret the value (e.g. @file)? [E4](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-the-curl-quirk-that-exposed-burp-suite-amp-google-chrome.md)
- Does the validator tokenize like the real parser (statement separators, blocks, comments)? [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-cf23-7qxj-xmhr.md)
- Enumerate every write path for the same operation and confirm each calls the validator; diff sibling handlers [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-76pm-mq2q-9gcr.md)[E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-9jww-cxg5-rj9m.md)[E7](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r62-gj48-897x.md)
- Can a low-privilege user edit this field, and does a "Test connection" action trigger the sink? [E8](https://bugbountylibrary.com/r/h1%3A2065288.md)

## Variants seen
- Version field traversing into an attacker-controlled download URL [E3](https://bugbountylibrary.com/r/h1%3A1895316.md)
- Extra fields (version, binary_path) into download and exec [E3](https://bugbountylibrary.com/r/h1%3A1895316.md)
- JDBC driver path and class instantiated from a user jar on connection test [E8](https://bugbountylibrary.com/r/h1%3A2065288.md)
- Generated curl command where a leading @ in the body reads a local file (file-read, not RCE) [E4](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-the-curl-quirk-that-exposed-burp-suite-amp-google-chrome.md)
- Denylist bypassed by same-line `;`-separated directives [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-cf23-7qxj-xmhr.md)
- Validator wired into three of four write paths; the MCP add tool skipped it [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-76pm-mq2q-9gcr.md)[E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-9jww-cxg5-rj9m.md)[E7](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r62-gj48-897x.md)
- Blacklist missing a network-rewriting flag, enabling MITM/RCE (adjacent) [E1](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2018-05-24-electron-win-protocol-handler-bug-bypass-html.md)

## Why fixes fail
Blacklisting one directive left others usable [E1](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2018-05-24-electron-win-protocol-handler-bug-bypass-html.md). Validating one field (sql_proxy_version) while leaving sql_proxy_binary_path open [E3](https://bugbountylibrary.com/r/h1%3A1895316.md). A hardening commit added the validator to some handlers but missed the newest sibling [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-76pm-mq2q-9gcr.md)[E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-9jww-cxg5-rj9m.md)[E7](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r62-gj48-897x.md). Fixes must cover every field and every write path feeding the sink, not just the reported one.

## Impact and severity
Arbitrary command execution as the service account or worker user, and root-level code execution in the daemon's worker context [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-cf23-7qxj-xmhr.md)[E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-76pm-mq2q-9gcr.md)[E7](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r62-gj48-897x.md)[E8](https://bugbountylibrary.com/r/h1%3A2065288.md). Severity is high because the trigger is often a low-privilege config edit or a single "Test connection" click [E8](https://bugbountylibrary.com/r/h1%3A2065288.md). E4 is file disclosure only.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2018-05-24-electron-win-protocol-handler-bug-bypass-html.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-cf23-7qxj-xmhr.md
- E3: https://bugbountylibrary.com/r/h1%3A1895316.md
- E4: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-the-curl-quirk-that-exposed-burp-suite-amp-google-chrome.md
- E5: https://bugbountylibrary.com/r/ghsa%3AGHSA-76pm-mq2q-9gcr.md
- E6: https://bugbountylibrary.com/r/ghsa%3AGHSA-9jww-cxg5-rj9m.md
- E7: https://bugbountylibrary.com/r/ghsa%3AGHSA-5r62-gj48-897x.md
- E8: https://bugbountylibrary.com/r/h1%3A2065288.md