T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:283
- Finding
- PostgreSQL Container Exposed with a Predictable Hardcoded Password## Vulnerability Details **File Location**: `SKILL.md`, lines 283-290 **Vulnerability Type**: Hardcoded weak credential and unsafe network exposure **Risk Level**: High ```bash docker run -d \ --name postgres \ -e POSTGRES_PASSWORD=secret \ -e POSTGRES_DB=mydb \ -v postgres-data:/var/lib/postgresql/data \ -p 5432:5432 \ postgres:15 ``` ### Technical Analysis The documented workflow configures PostgreSQL with the predictable password `secret`. It also publishes container port 5432 to host port 5432 without specifying a loopback address. Docker therefore normally binds the published port to all host interfaces. If a user copies this example into a network-accessible environment, an attacker who can reach TCP port 5432 can attempt to authenticate using the documented password. Embedding the password directly in the command also risks disclosure through shell history, process inspection, terminal logs, and copied deployment records. ### Attack Path 1. A user copies and executes the documented database command. 2. Docker starts PostgreSQL with the password `secret`. 3. Docker publishes TCP port 5432 on the host's available network interfaces. 4. An attacker discovers the exposed PostgreSQL service through network scanning or prior knowledge. 5. The attacker connects to the service and attempts authentication using the predictable password `secret`. 6. If authentication succeeds, the attacker gains the permissions assigned to the authenticated PostgreSQL account. Exploitation requires network access to the published port and a compatible database username or another means of identifying it. ### Impact Assessment Successful exploitation could permit unauthorized reading, modification, insertion, or deletion of data accessible to the compromised PostgreSQL account. The attacker could also disrupt the database or misuse PostgreSQL functionality available to that account. The direct impact is limited b ...[truncated 177 chars]
- Remediation
- ## Remediation Suggestions - Replace the fixed password with a strong, randomly generated secret. - Supply credentials through Docker secrets or another dedicated secret-management mechanism rather than placing them directly in the command line. - If an environment file is used for local development, restrict its filesystem permissions and exclude it from version control. - When only local host access is required, bind the port explicitly to loopback, for example: `-p 127.0.0.1:5432:5432`. - When only other containers require database access, do not publish the database port. Attach the containers to a private Docker network instead. - Apply host firewall rules and network access controls when remote database access is necessary. - Use a dedicated, least-privileged PostgreSQL role for the application and restrict access to only the required databases, schemas, and operations. - Update the documentation to label any development-only example clearly and warn users not to deploy predictable credentials or unrestricted port bindings in production.