T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:27
- Finding
- Session credential stored without restrictive file permissions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27-32 **Vulnerability Type**: Insecure storage of an authenticated session cookie **Risk Level**: Medium ### Vulnerable Code ```sh export ARTSONIA_USERNAME=you@example.com export ARTSONIA_PASSWORD='your-password' # or: op read "op://Private/Artsonia/password" JAR=~/.cache/artsonia-cookies.txt mkdir -p ~/.cache # ensure the jar's directory exists on a fresh box : > "$JAR" # fresh jar ``` ### Technical Analysis The cookie jar receives the authenticated Artsonia session cookie but is created using ordinary shell redirection. Neither the cache directory nor the cookie file is explicitly assigned restrictive permissions. The effective permissions therefore depend on the existing directory configuration and the user's `umask`. A session cookie is a bearer credential. Anyone able to read it may authenticate to Artsonia without knowing the account password until the session expires or is revoked. Although the network transmission of credentials to the declared Artsonia login endpoint is necessary for the Skill's stated functionality, leaving the resulting credential insufficiently protected exceeds the minimum local exposure necessary. ### Attack Path 1. A victim follows the documented setup and login procedure. 2. Artsonia writes an authenticated session cookie into `~/.cache/artsonia-cookies.txt`. 3. The victim's `umask`, cache directory permissions, backup configuration, or another local service makes the file readable by an unintended local account or process. 4. An attacker copies the cookie jar. 5. The attacker supplies the stolen cookie to `curl` or another HTTP client. 6. The attacker accesses authenticated Artsonia member endpoints as the victim until the session expires or is invalidated. ### Impact Assessment Successful exploitation permits session impersonation within the privileges of the affected Artsonia account. This can expose profile information, student portfolios, ...[truncated 427 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Create both the cache directory and cookie jar with explicit restrictive permissions, rather than relying on the ambient `umask`: ```sh umask 077 JAR="$HOME/.cache/artsonia-cookies.txt" install -d -m 700 "$HOME/.cache" install -m 600 /dev/null "$JAR" ``` Additional hardening should include: - Verify the cookie file is owned by the current user before every use. - Refuse to use a symbolic link as the cookie-jar path. - Delete the cookie jar when the operation finishes if persistent sessions are unnecessary. - Document how to invalidate the server-side session. - Avoid including the cookie jar in backups, synchronization tools, logs, or source-control repositories. ]]>