T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cdp-utils.js:21- Finding
Administrator Bearer Token Exposed Through Process Command-Line Arguments
- Content
View full analysis
`"${a.replace(/"/g, '\\"')}"`).join(" "); try { return execSync(`agent-browser --cdp ${port} ${cmd}`, { encoding: "utf-8", timeout: 20000, stdio: ["pipe", "pipe", "pipe"], }).trim(); } catch (e) { return e.stdout?.trim() || ""; } } ``` The credential reaches this function through browser-evaluation JavaScript constructed as follows: ```js function fetchBookList(port, token, pageNum) { const t = safeStr(token); const js = "fetch(" + safeStr(API_BASE + "/manage/book/list") + "," + "{method:'POST'," + "headers:{" + "'Content-Type':'application/x-www-form-urlencoded'," + "'Authorization':'Bearer '+" + t + "}," + "body:new URLSearchParams({pageNum:" + safeStr(pageNum) + ",pageSize:" + safeStr(PAGE_SIZE) + ",language:'zh_TW'})" + "}).then(function(r){return r.json()})"; return evalJSON(port, js); } function fetchBookDetail(port, token, bookId) { const t = safeStr(token); const js = "fetch(" + safeStr(API_BASE + "/manage/book/" + encodeURIComponent(bookId)) + "," + "{headers:{'Authorization':'Bearer '+" + t + "}}" + ").then(function(r){return r.json()})"; return evalJSON(port, js); } ``` ### Technical Analysis The Black Rock scraper reads an `Admin-Token` cookie and embeds its value in JavaScript containing an HTTP `Authorization` header. This entire JavaScript string is then passed to `agent-browser` by constructing a shell command. Consequently, the raw bearer token can appear in the command-line arguments of the shell and the `agent-browser` process while the request is running. Depending on operating-system process visibil ...[truncated 1523 chars]- Remediation
View remediation