T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/auto_playwright.py:29
- Finding
- Persistent Plaintext Collection and Storage of Authentication Cookies<![CDATA[ ## Vulnerability Details **File Location**: `scripts/auto_playwright.py:29-58` **Vulnerability Type**: Excessive credential collection and insecure plaintext storage **Risk Level**: High ### Vulnerable Code ```python state = browser.storage_state() # Format SameSite exactly as expected by the CLI API for c in state.get("cookies", []): samesite = str(c.get("sameSite", "Lax")).capitalize() if samesite == "None": samesite = "None" c["sameSite"] = samesite print(f"5. Found {len(state.get('cookies', []))} cookies. Saving to disk...") # Ensure the .notebooklm folder exists os.makedirs(os.path.dirname(state_path), exist_ok=True) with open(state_path, "w") as f: json.dump(state, f) env_json = json.dumps({"cookies": state.get("cookies", [])}) with open(payload_path, "w") as f: f.write(env_json) print(f"Saved auth payload to {payload_path}") # Automatically apply to Windows User Environment Variable to bypass the Playwright browser lock bug if sys.platform == "win32": print("Injecting cookies into Windows Environment Variable NOTEBOOKLM_AUTH_JSON...") subprocess.run([ "powershell", "-Command", f'[Environment]::SetEnvironmentVariable("NOTEBOOKLM_AUTH_JSON", \'{env_json}\', "User")' ], check=True) ``` The behavior is also explicitly directed by `SKILL.md:18-22`: ```markdown 4. **Auth Recovery:** If `notebooklm` fails with "Authentication expired", you MUST ask the user for explicit permission before recovering. Propose running `python {WORKSPACE_DIR}/skills/notebooklm-bypass/scripts/auto_playwright.py`. If and only if they approve, run the script. This script steals fresh cookies and automatically injects them into your Windows Environment Variables. Once complete, retry your command. ``` ### Technical Analysis `browser.storage_state()` collects the complete cookie state available to the persistent browser context. The script does not restrict collection to an explicit allowlist of NotebookLM do ...[truncated 2122 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace broad `storage_state()` credential export with an explicit allowlist of the minimum required NotebookLM domains and cookie names. 2. Do not persist duplicate copies of authentication material. 3. Prefer passing short-lived credentials directly to the immediate child process rather than storing them in a user-level environment variable. 4. Use an operating-system credential manager such as Windows Credential Manager, macOS Keychain, or a Linux Secret Service implementation if persistence is unavoidable. 5. On POSIX systems, create credential files with owner-only permissions such as mode `0600`, independent of the user's current `umask`. 6. Define and enforce an expiration and cleanup process for all stored authentication state. 7. Avoid logging cookie values and ensure that exceptions cannot disclose them. 8. Explain exactly which credentials are collected, where they are stored, how long they remain, and how users can revoke or delete them before requesting consent. 9. Consider using the supported `notebooklm login` authentication flow instead of extracting and repackaging browser cookies. ]]>