T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/setup-org-db.sh:19
- Finding
- Database Connection Credentials Exposed in Standard Output## Vulnerability Details **File Location**: `scripts/setup-org-db.sh`, lines 19 and 88 **Vulnerability Type**: Plaintext sensitive-data disclosure **Risk Level**: High ### Vulnerable Code ```bash CONN_STRING=$(neonctl connection-string --project-id "$PROJECT_ID" --pooled) ``` ```bash echo "Project ID: $PROJECT_ID" echo "Connection: $CONN_STRING" echo "" echo "Save these to your org config!" ``` ### Technical Analysis The script retrieves a Neon PostgreSQL connection string and stores it in `CONN_STRING`. Such connection strings normally include a database username, password, hostname, and database name. Line 88 then prints the complete value to standard output without redaction. Standard output is frequently retained in CI/CD job logs, terminal capture files, AI Agent transcripts, centralized log aggregation systems, and automation records. Consequently, a user or service with permission to read those records may obtain reusable database credentials even if they are not authorized to access Neon secrets directly. ### Attack Path 1. An authorized user or automation service executes `scripts/setup-org-db.sh`. 2. `neonctl connection-string` returns a credential-bearing PostgreSQL URI. 3. The script prints the complete URI to standard output. 4. A CI system, Agent platform, terminal recorder, or logging service retains the output. 5. An attacker or lower-privileged user obtains read access to the retained output. 6. The exposed URI is supplied to `psql` or another PostgreSQL client. 7. The attacker gains the database privileges assigned to the role embedded in the URI. ### Impact Assessment Exploitation can grant remote access to the newly created Neon database with all privileges assigned to the disclosed database role. Depending on that role, an attacker may be able to read, insert, modify, or delete organizational leads, tasks, metrics, and activity-log data. The attacker may also alter the schema or d ...[truncated 293 chars]
- Remediation
- ## Remediation Suggestions - Remove the statement that prints `CONN_STRING`. - Display only non-sensitive identifiers, such as the Neon project ID and a redacted database hostname. - Transfer the connection URI directly into an approved secret manager rather than returning it in terminal output. - If a local configuration file is necessary, create it with restrictive permissions such as mode `0600`, avoid committing it to version control, and document its sensitive nature. - Configure CI/CD and Agent platforms to mask known secret values and prevent command output containing credentials from being retained. - Rotate the associated Neon database password if the script has already been run in any logged environment. - Prefer a dedicated least-privileged application role rather than distributing a project owner or administrative connection string.