[Bug bounty] Telemetry script injects unescaped special characters into JSON payload, corrupting PostHog events

[arielbarbaro]

Stage: connect · Severity: medium (data corruption) · OS: all · Agent: all · plugin/agent: v0.1.52

Summary

The _msan sanitization function in scripts/monk-launcher-telemetry.sh does not properly escape all JSON special characters before injecting values into the hand-built JSON payload. This causes PostHog events to be silently corrupted when property values contain characters like <, >, &, tabs, or control characters.

Root cause

The _msan function in monk-launcher-telemetry.sh line:

_msan() { printf '%s' "$1" | tr -d '"\\' | tr -d '\n\r'; }

This function only strips double-quotes (") and backslashes (\), plus newlines. It does NOT handle other characters that are special in JSON strings:

• < and > (HTML/XML injection in property values)
• & (HTML entity issues)
• Tab characters (\t)
• Other control characters (0x00-0x1F except 0x0A and 0x0D which are handled)
• Unicode control characters

Reproduction

1. Set MONK_PLUGIN_VERSION='test<version>test' as environment variable
2. Run start-monk-agent.sh which sources monk-launcher-telemetry.sh
3. The _payload variable becomes: {"plugin_version":"test<version>test",...}
4. While < and > are technically valid in JSON strings, they cause issues with:
   • XML parsers (if PostHog ever processes events through XML pipelines)
   • HTML display in PostHog UI (XSS vector in event viewer)
5. More critically, if MONK_POSTHOG_HOST contains a quote: MONK_POSTHOG_HOST='https://test"test.com'
   The payload becomes: {"api_key":"...","event":"...","host":"https://test"test.com",...}
   This is INVALID JSON and the entire event is dropped by PostHog.

Impact

• PostHog events with special characters are silently corrupted or dropped
• No error logging when events fail to send
• Potential XSS vector if PostHog UI renders event properties without escaping
• Data loss in telemetry analytics

Fix

Replace the hand-built JSON with proper escaping:

_msan() {
  printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\t/\\t/g' -e 's/\r/\\r/g' -e 's/\n/\\n/g'
}

Or use jq to build the payload properly:

printf '{}' | jq --arg key "$_ph_key" --arg cid "$_cid" \
  --arg mlc "$_mlc" --argjson first "$_first_start" \
  --argjson installed "$_agent_installed" \
  '.api_key=$key | .event="plugin_launcher_started" | .distinct_id=$cid | .launch_client=$mlc | .first_start=$first | .agent_installed=$installed'

[nooga]

Good find — this is confirmed and accepted (the real corruption turned out to be unescaped control characters rather than the quote-stripping itself, but the underlying report is right that the payload can end up invalid). PR #189 fixes it properly and will be ported. To make it count for the bounty you still need to: ☐ install and run the plugin. Complete that before the campaign window closes and the points are yours.

[nooga]

Final reminder — the bounty window closes tomorrow, Aug 10 at 12:00 UTC.

An earlier comment here quoted a deadline that has since moved, so to be precise: your accepted findings are currently worth 1 provisional points, and they're being held for one reason only.

Your Monk account is verified. What's missing is usage: install the plugin and run it at least once with that account. That's the whole remaining step.

Do that before Aug 10, 12:00 UTC and the points are yours. Nothing else about your report needs to change — the finding itself is already accepted.