T09 · Insecure Skill Coding Practices
Error
- Location
- modules/incident-response.md:16
- Finding
- Plaintext Exposure of Sensitive Environment Variables in a Shared Temporary Directory## Vulnerability Details **File Location**: `modules/incident-response.md`, line 16 **Vulnerability Type**: Plaintext sensitive-data exposure and unsafe temporary-file handling **Risk Level**: High ### Vulnerable Code ```bash env > /tmp/env_snapshot_$(date +%s).txt ``` ### Technical Analysis The incident-response procedure instructs the operator to copy the process's entire environment into a plaintext file in `/tmp`. Environment variables frequently contain cloud credentials, database passwords, API tokens, Kubernetes tokens, SSH-related configuration, and other secrets. The same document explicitly recognizes that environment variables may contain such credentials. The command does not: - Filter or redact secret-bearing variables. - Set a restrictive `umask` or explicit file permissions. - Use a private, access-controlled evidence directory. - Encrypt the captured evidence. - Define secure retention and deletion requirements. - Create the file using a mechanism designed to resist temporary-file attacks. The timestamp-based name is predictable. Depending on operating-system temporary-directory protections and shell behavior, an attacker with local access may monitor for the resulting file or attempt to prepare a matching path. Even without such manipulation, the plaintext snapshot can persist after incident handling and may be collected by backups, forensic utilities, support bundles, or unrelated processes with sufficient filesystem access. ### Attack Path 1. A suspected supply-chain incident causes an operator or automation agent to follow the documented containment procedure. 2. The affected process has sensitive credentials in its environment. 3. The operator executes: ```bash env > /tmp/env_snapshot_$(date +%s).txt ``` 4. The complete environment, including any credential values, is written to a predictable plaintext path in the shared temporary directory. 5. A local user, compromised process, privileged diagnostic tool, backup process, ...[truncated 1144 chars]
- Remediation
- ## Remediation Suggestions 1. Do not capture the complete environment by default. Record only an explicit allowlist of non-sensitive diagnostic variables. 2. Redact values for variable names associated with passwords, secrets, tokens, keys, credentials, cookies, and connection strings. 3. If a complete snapshot is strictly necessary for authorized forensic work: - Create a dedicated evidence directory owned by the incident responder. - Set `umask 077` before creating evidence. - Ensure directories use mode `0700` and files use mode `0600`. - Generate filenames with a secure temporary-file facility rather than timestamps alone. - Encrypt evidence at rest with access restricted to the incident-response team. 4. Document chain-of-custody, retention, transfer, and secure-deletion requirements. 5. Rotate any credentials included in a captured environment immediately after evidence preservation. 6. Replace the unsafe instruction with an allowlist-based example, such as: ```bash umask 077 evidence_dir="$(mktemp -d "${HOME}/incident-evidence.XXXXXX")" { printf 'PATH=%s\n' "$PATH" printf 'SHELL=%s\n' "$SHELL" printf 'LANG=%s\n' "$LANG" } > "${evidence_dir}/environment-summary.txt" ``` The allowlist must be reviewed for the actual deployment because even normally benign variables can contain sensitive paths or identifiers.