T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sync-review.sh:163- Finding
Anonymous upload discloses the local username and a persistent host-derived identifier
- Content
View full analysis
/dev/null; then USER_ID=$(echo -n "$RAW_ID" | shasum -a 256 | cut -c1-16) elif command -v sha256sum &>/dev/null; then USER_ID=$(echo -n "$RAW_ID" | sha256sum | cut -c1-16) else USER_ID=$(echo -n "$RAW_ID" | md5sum 2>/dev/null | cut -c1-16 || echo "$RAW_ID") fi fi USER_NAME="${IELTS_USER_NAME:-$(whoami)}" ``` ```bash RESPONSE=$(curl -s -w "\n%{http_code}" \ -X POST "$LEGACY_BASE/skill-review" \ -H "Content-Type: application/json" \ -H "x-api-key: $LEGACY_API_KEY" \ -H "x-user-id: $USER_ID" \ -H "x-user-name: $USER_NAME" \ -d "$PAYLOAD") ``` ### Technical Analysis When authenticated mode is unavailable, the script automatically falls back to anonymous mode. In that mode, it derives a stable identifier from `hostname` and `whoami`, truncates the hash to 16 hexadecimal characters, and transmits it as `x-user-id`. It also sends the clear operating-system username as `x-user-name`. A stable identifier may be useful for associating multiple anonymous uploads with one dashboard. However, deriving it from host-specific information and transmitting the clear local username exceeds what is necessary for that purpose. An unsalted, truncated hash of predictable inputs is pseudonymous rather than anonymous and may be susceptible to guessing when hostnames and usernames follow common patterns. ### Attack Path 1. A user runs `sync-review.sh` without setting `IELTS_USER_TOKEN`. 2. Browser authorization is unavailable, declined, or unsuccessful. 3. The script silently selects anonymous mode after printing a warning. 4. It reads the machine hostname a ...[truncated 751 chars]- Remediation
View remediation