T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:199
- Finding
- Hardcoded Elasticsearch Administrative Credential in Documentation## Vulnerability Details **File Location**: `SKILL.md`, lines 199–204 **Vulnerability Type**: Hardcoded administrative credential **Risk Level**: High **Complete Code Snippet**: ```bash 4. **Check .kibana index health:** ```bash # Query from within k8s cluster kubectl exec -n elastic elasticsearch-0 -- curl -s -u 'elastic:Changeme123' \ 'http://localhost:9200/.kibana/_search?size=100' \ -H 'Content-Type: application/json' \ -d '{"query": {"prefix": {"type": "index-pattern"}}}' ``` ``` ### Technical Analysis The Skill embeds the Basic Authentication credential `elastic:Changeme123` in an executable troubleshooting command. The `elastic` user is conventionally an Elasticsearch superuser, so this credential may provide substantially more privileges than are required merely to inspect Kibana index-pattern records. Any person or process able to read the project can recover the credential. If the documented command is executed, the secret may also be retained in shell history or temporarily exposed through process-argument inspection. The request uses HTTP, although it targets the pod-local interface in this example. ### Attack Path 1. An attacker obtains read access to the Skill package or its documentation. 2. The attacker extracts the username and password from `SKILL.md`. 3. The attacker obtains network access to Elasticsearch or permission to execute commands in the named Kubernetes pod. 4. The attacker authenticates using the exposed `elastic` credential. 5. If the credential remains valid and retains its expected privileges, the attacker queries, modifies, or deletes resources available to that account. Exploitation depends on the credential being valid and the attacker having a reachable path to Elasticsearch. ### Impact Assessment If valid, the credential may grant Elasticsearch superuser privileges rather than read-only access to `.kibana`. The potential scope includes disclosure or modifica ...[truncated 285 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the username and password from `SKILL.md` and all repository history where practical. 2. Immediately rotate the credential if it has ever been valid. 3. Replace the superuser with a dedicated, least-privileged service account that has only the read permissions required for the diagnostic query. 4. Store credentials in Kubernetes Secrets or an approved secret manager and inject them at runtime. 5. Avoid passing passwords directly through command-line arguments. Use a protected credential file, environment-based secret injection where appropriate, or another mechanism supported by the organization’s secret-management controls. 6. Use HTTPS with certificate verification for non-local Elasticsearch and Kibana communication. 7. Add automated secret scanning to pre-commit and CI pipelines to prevent future credential commits. 8. Review access logs for use of the exposed account and investigate unexpected authentication or administrative activity.