T09 · Insecure Skill Coding Practices
Warning
- Location
- references/chrome-relay-setup.md:8
- Finding
- Gateway Authentication Token Exposed in Terminal Output<![CDATA[ ## Vulnerability Details **File Location**: `references/chrome-relay-setup.md`, lines 8–14 **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: Medium ### Vulnerable Code ```markdown 3. Configure: - Port: 18792 - Gateway token: from ~/.openclaw/openclaw.json -> gateway.auth.token ## Get Token ```bash cat ~/.openclaw/openclaw.json | grep -A5 auth ``` ``` ### Technical Analysis The setup guide instructs users to read the OpenClaw configuration file and print the authentication section, including five subsequent lines, to standard output. This can disclose the gateway authentication token and potentially adjacent sensitive configuration. Although the guide warns users not to paste the token into chat, the command itself still exposes sensitive values in the terminal. The output may be captured by terminal logging, shell-session recording, screen sharing, screenshots, CI logs, support transcripts, or clipboard-based troubleshooting. The broad `grep -A5 auth` selection may also reveal more data than the single required token. This is a sensitive-data handling weakness rather than automatic exfiltration: exploitation requires an attacker to obtain the exposed output or otherwise observe the terminal session. ### Attack Path 1. A user follows the documented setup procedure. 2. The user executes `cat ~/.openclaw/openclaw.json | grep -A5 auth`. 3. The gateway token and neighboring configuration are printed in plaintext. 4. The output is captured through terminal logging, screen sharing, screenshots, session recording, or troubleshooting material. 5. An attacker with access to that output extracts the gateway token. 6. If the attacker can reach the associated OpenClaw Gateway, the attacker attempts to authenticate with the disclosed token. 7. Successful authentication may permit use of gateway capabilities, including control of browser tabs that the user has exposed through the relay. ### Impact Assessment Disclosure of t ...[truncated 640 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the command that prints the authentication section to standard output. - Direct users to a protected configuration interface that masks credentials and supports secure copy operations. - If command-line extraction is unavoidable, retrieve only the exact token field rather than surrounding lines, and avoid displaying it in terminal output. - Prefer a secure configuration command that reads the token directly from the protected file or standard input without echoing it. - Ensure the configuration file has restrictive permissions, such as owner-only read and write access. - Warn users not to include terminal output containing credentials in logs, screenshots, support tickets, chat messages, or screen-sharing sessions. - Redact gateway tokens automatically from diagnostic output and logging systems. - Provide documented token-rotation and revocation procedures, and instruct users to rotate any token that may have been exposed. - Restrict the gateway to loopback or otherwise trusted network interfaces unless remote access is explicitly required, and apply least-privilege controls to gateway capabilities. ]]>