T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:184
- Finding
- Known Weak Default Administrator Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 184-189 **Vulnerability Type**: Hardcoded weak default credentials **Risk Level**: Medium **Vulnerable code snippet**: ```markdown ## Default Credentials After `shopyo initialise`: - URL: http://localhost:5000 - Login: http://localhost:5000/auth/login - Email: `admin@domain.com` - Password: `pass` ``` ### Technical Analysis The documented initialization procedure creates or exposes an administrator account using the publicly known credentials `admin@domain.com` and `pass`. The password is trivial, shared across initialized installations, and disclosed directly in the skill documentation. The documentation does not state that initialization generates unique credentials, forces a password change, disables the default account, or prevents the application from being exposed before credential rotation. Although the listed URL uses localhost, the account becomes exploitable if the application is bound to an externally accessible interface, deployed without changing the credentials, exposed through a reverse proxy, or made reachable through port forwarding. ### Attack Path 1. A user creates and initializes a Shopyo application with `shopyo initialise`. 2. The initialized application retains the documented default administrator account. 3. The application is made reachable by an untrusted party, intentionally or accidentally. 4. An attacker visits `/auth/login`. 5. The attacker authenticates with `admin@domain.com` and `pass`. 6. The attacker gains whatever administrative capabilities the application assigns to that default account. ### Impact Assessment Successful exploitation provides authenticated administrator-level access within the affected Shopyo application. The precise capabilities depend on the generated application's authorization model, but may include access to administrative pages, application data, configuration functions, and privileged ...[truncated 237 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the fixed `admin@domain.com` / `pass` credential pair from the initialization workflow. 2. Generate a cryptographically random, unique initial password for each installation and display it only once through an appropriate secure channel. 3. Alternatively, require the operator to provide an administrator email and strong password interactively or through a protected secret-management mechanism. 4. Force a password change during the administrator's first successful login. 5. Prevent startup in production profiles when known default credentials are detected. 6. Store passwords only as hashes produced by a modern password-hashing function such as Argon2id, scrypt, or bcrypt with appropriate parameters. 7. Update the documentation to warn users not to expose the service before rotating bootstrap credentials. 8. Consider disabling or expiring the bootstrap account automatically after initial setup. 9. Add automated tests or deployment checks that reject weak and documented default passwords.