T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/notifier.py:50
- Finding
- Telegram Bot Token May Be Disclosed Through Exception Logging## Vulnerability Details **File Location**: `scripts/notifier.py`, lines 50–68 **Vulnerability Type**: Secret exposure through unsanitized exception logging **Risk Level**: Medium ### Vulnerable Code ```python url = f"{self.api_url}{self.bot_token}/sendMessage" data = { 'chat_id': self.chat_id, 'text': message, 'parse_mode': parse_mode } response = requests.post(url, json=data, timeout=10) result = response.json() if result.get('ok'): print(f"✅ Telegram message sent successfully") return True else: print(f"❌ Telegram delivery failed: {result.get('description')}") return False except Exception as e: print(f"❌ Telegram delivery exception: {e}") return False ``` ### Technical Analysis The Telegram bot token is embedded directly in the request URL. Exceptions raised by the HTTP client or its underlying networking components can include the requested URL. Printing the raw exception without redaction may therefore write the bot token to terminal output, CI logs, service logs, or centralized monitoring systems. Sending alert data to Telegram is necessary for the Skill's declared notification functionality, and no intentional exfiltration was identified. The vulnerability is instead caused by unsafe handling of errors around a credential-bearing URL. ### Attack Path 1. A user configures the Skill with a valid Telegram bot token. 2. An attacker, proxy, malformed network environment, or ordinary connectivity failure causes the Telegram request to raise an exception. 3. The exception representation includes all or part of the token-bearing request URL. 4. The handler prints the raw exception to an accessible log destination. 5. An attacker with access to those logs extracts the bot token. 6. The attacker uses Telegram's Bot API with the recovered token to impersonate or misuse the bot within its Telegram-granted capabilities. Exploitation depends on the except ...[truncated 473 chars]
- Remediation
- ## Remediation Suggestions - Do not print or persist raw exceptions from requests whose URLs contain credentials. - Replace raw exception output with a sanitized message containing only a safe error category, such as the exception class and a redacted description. - Apply centralized log redaction for Telegram URL patterns, replacing `/bot<token>/` with `/bot[REDACTED]/`. - Avoid passing the credential-bearing URL to generic logging utilities. - Ensure CI, service, and centralized logs have restrictive access controls and appropriate retention periods. - Rotate the Telegram bot token immediately if it may already have appeared in logs. - Add automated tests that simulate request failures and assert that captured output does not contain the configured token.