T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/submit-with-mfa.js:35
- Finding
- MFA Codes Are Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/submit-with-mfa.js:35-43`, `scripts/mfa-login.js:101-104`, `scripts/submit-daily.js:27-32`, and `SKILL.md:128-141` **Vulnerability Type**: Sensitive authentication data exposed through process arguments **Risk Level**: Medium ### Complete Code Snippet ```javascript const args = process.argv.slice(2); let mfaCode = null; let targetDate = new Date().toISOString().split('T')[0]; let requireMFAAutoDetect = true; for (let i = 0; i < args.length; i++) { if (args[i] === '--code') { mfaCode = args[++i]; requireMFAAutoDetect = false; } if (args[i] === '--date') targetDate = args[++i]; if (args[i] === '--force-mfa') requireMFAAutoDetect = false; if (args[i] === '--no-mfa') requireMFAAutoDetect = true; } ``` The documented invocation is: ```bash node scripts/submit-with-mfa.js --code [MFA_CODE_HERE] ``` ### Technical Analysis MFA codes are supplied through the process command line. Command-line arguments are not an appropriate secret-transport mechanism because they may be exposed through: - Process inspection tools such as `ps` or `/proc/<pid>/cmdline` - Shell history - Cron configuration and execution logs - Process monitoring or endpoint telemetry - Terminal session recording - Wrapper scripts and automation logs Although an MFA code has a short lifetime, the workflow explicitly emphasizes immediate use. A local observer could therefore capture and reuse the code while it remains valid. The exposure is particularly significant when combined with separately compromised M365 credentials. ### Attack Path 1. The user or scheduled workflow runs the submission script with `--code 123456`. 2. A local user, monitoring agent, or log collector records the process arguments. 3. The attacker extracts the MFA code before it expires. 4. If the attacker also possesses the account password or has initiated a matching authentication attempt, the code can be used to complete that attempt. 5. The a ...[truncated 454 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove support for accepting MFA codes through `process.argv`. - Read the code from a hidden interactive prompt when a TTY is available. - For automation, accept the value through a protected pipe or inherited file descriptor. - If a temporary file is unavoidable, require owner-only permissions, read it once, and delete it immediately. - Do not embed MFA codes in cron commands, shell scripts, environment variables, or logs. - Update `SKILL.md` and testing documentation to remove all `--code XXXXXX` examples. - Prefer an officially supported authentication flow that does not require automating transient MFA secrets. ]]>