T09 · Insecure Skill Coding Practices
Error
- Location
- references/download-issues.sh:73
- Finding
- SonarQube bearer token may be exposed through plaintext transport and process arguments<![CDATA[ ## Vulnerability Details **File Location**: `references/download-issues.sh`, lines 73-80 **Vulnerability Type**: Bearer-token exposure through unrestricted transport and command-line arguments **Risk Level**: High ### Vulnerable Code ```bash AUTH_HEADER="" if [ -n "$SONAR_TOKEN" ]; then AUTH_HEADER="Authorization: Bearer $SONAR_TOKEN" fi if [ -n "$AUTH_HEADER" ]; then curl -fs "$API_URL" -H "$AUTH_HEADER" else curl -fs "$API_URL" fi ``` ### Technical Analysis The SonarQube base URL is obtained from environment-controlled configuration, but the script does not require HTTPS before attaching the bearer token. If a configured URL uses plain HTTP, the authorization header and returned SonarQube issue data are transmitted without transport encryption. The authorization header is also supplied to `curl` as a command-line argument. Depending on operating-system process visibility and execution environment, another local user or monitoring process may be able to inspect the argument while `curl` is running. Shell tracing or command-capture infrastructure could expose it as well. Although sending a token to the configured SonarQube server is necessary for the Skill's declared function, allowing plaintext transport and exposing the header through command arguments are not necessary privileges or disclosures. ### Attack Path 1. An attacker influences the SonarQube URL configuration or convinces a user to configure an `http://` endpoint. 2. The Skill constructs `API_URL` from that endpoint. 3. The script invokes `curl` with `Authorization: Bearer $SONAR_TOKEN`. 4. The token traverses the network without TLS and can be captured by an on-path observer. 5. Alternatively, a local process with permission to inspect process arguments reads the bearer header while `curl` is running. 6. The attacker reuses the recovered token against the SonarQube API. ### Impact Assessment A successful attacker obtains the permissions assigned to the exposed SonarQube to ...[truncated 320 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Reject non-HTTPS SonarQube URLs by default. 2. Permit HTTP only for explicitly approved loopback endpoints such as `localhost` or `127.0.0.1`, with a clear development-only opt-in. 3. Validate the URL scheme and host before attaching an authorization header. 4. Avoid placing the complete bearer header in process arguments. Use a protected temporary curl configuration or supported credential mechanism that is not visible in the ordinary process list. 5. If a temporary configuration file is used: - Create it with mode `0600`. - Store it in a securely created temporary directory. - Install an `EXIT` trap to remove it. - Never print its contents. 6. Disable shell tracing around credential-bearing operations and document that verbose command logging must not capture secrets. 7. Apply minimum scopes and expiration periods to SonarQube tokens. ]]>