T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/lastfm-api.sh:92
- Finding
- Sensitive Last.fm credentials exposed through command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lastfm-api.sh:92-130`; `references/auth-guide.md:101-110` **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code `scripts/lastfm-api.sh:92-130`: ```bash make_request() { local method="$1" shift local extra_params=("$@") local url="${LASTFM_API_ROOT}?method=${method}&user=$(url_encode "$LASTFM_USERNAME")&api_key=${LASTFM_API_KEY}&format=json" for param in "${extra_params[@]}"; do url+="&${param}" done curl -s "$url" } make_write_request() { local method="$1" local artist="$2" local track="$3" check_write_vars local artist_enc artist_enc=$(url_encode "$artist") local track_enc track_enc=$(url_encode "$track") local api_sig api_sig=$(generate_signature \ "api_key${LASTFM_API_KEY}" \ "artist${artist}" \ "method${method}" \ "sk${LASTFM_SESSION_KEY}" \ "track${track}" ) local url="${LASTFM_API_ROOT}" local data="method=${method}&api_key=${LASTFM_API_KEY}&artist=${artist_enc}&track=${track_enc}&sk=${LASTFM_SESSION_KEY}&api_sig=${api_sig}&format=json" curl -s -X POST -d "$data" "$url" } ``` `references/auth-guide.md:101-110`: ```bash API_KEY="your_api_key" API_SECRET="your_secret" TOKEN="your_token" # Create signature string (params in alphabetical order, without format) SIG_STRING="api_key${API_KEY}methodauth.getSessiontoken${TOKEN}${API_SECRET}" SIGNATURE=$(echo -n "$SIG_STRING" | md5sum | cut -d' ' -f1) # Request session key curl "https://ws.audioscrobbler.com/2.0/?method=auth.getSession&api_key=${API_KEY}&token=${TOKEN}&api_sig=${SIGNATURE}&format=json" ``` ### Technical Analysis The implementation expands the Last.fm API key, long-lived session key, API signature, artist name, and track name into arguments supplied directly to `curl`. HTT ...[truncated 2999 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Keep sensitive POST data out of the `curl` argument vector by supplying it through standard input: ```bash printf '%s' "$data" | curl --silent --show-error \ --request POST \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-binary @- \ "$LASTFM_API_ROOT" ``` 2. Prefer constructing form fields with `curl --data-urlencode` semantics, but use a protected configuration file or standard-input mechanism when fields contain session credentials. Do not place the long-lived session key directly in command arguments. 3. Avoid placing authentication tokens and signatures in URLs in documentation. Provide a small helper script that reads credentials from protected environment variables and transmits request data through standard input. 4. Warn users not to paste live secrets into interactive commands. If manual authentication is unavoidable, instruct them to disable history temporarily or execute the procedure in a non-interactive script with restrictive permissions. 5. Ensure any temporary credential or request files are created with owner-only permissions, such as mode `0600`, and deleted immediately after use. Prefer memory or standard input so no temporary file is needed. 6. Use `curl --silent --show-error --fail-with-body` and handle failures explicitly so authentication errors are detected without printing complete request data. 7. Rotate the API secret and revoke the Last.fm application session if process telemetry, shell history, or diagnostic logs may already contain these values. ]]>