T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/get_status.sh:5
- Finding
- Plaintext Credential Storage and Process Argument Exposure<![CDATA[ ## Vulnerability Details **File Location**: `scripts/get_status.sh`, lines 5-12 **Vulnerability Type**: Plaintext sensitive-data handling **Risk Level**: Medium ### Vulnerable Code ```bash KEY="你的KEY" TEL="你的手机号" IMEI="你的IMEI" URL="https://www.cd6969.com/admin.php?s=/Admin/ApiV2/getList.html" response=$(curl -s -X POST "$URL" \ -H "Content-Type: application/json" \ -d "{\"key\":\"$KEY\",\"tel\":\"$TEL\"}") ``` ### Technical Analysis The script is designed for users to replace the placeholder values with an API key, telephone number, and IMEI. This stores authentication and personal data directly in an executable source file. Such values may consequently be exposed through repository commits, source archives, backups, file sharing, or access by other users who can read the script. The API key and telephone number are also interpolated into the argument supplied to `curl` through `-d`. On systems where process arguments are visible to other users or monitoring services, the complete request body may be captured from the process list, process-accounting records, audit logs, or diagnostic tooling while `curl` is running. The request is sent over HTTPS to the service documented by the Skill, so no unauthorized destination or malicious exfiltration was identified. The vulnerability concerns local storage and handling of the credentials before transport. ### Attack Path 1. A user replaces the placeholders in `scripts/get_status.sh` with a valid API key, telephone number, and IMEI. 2. The sensitive values remain stored as plaintext in the script. 3. An attacker with read access to the project, a copied repository, a backup, or an archive obtains the configured values. 4. Alternatively, a local user or monitoring service observes the `curl` command while it runs and captures the API key and telephone number from its request-data argument. 5. The attacker submits requests to the same API using the disclosed credentials, subject to the authorization ...[truncated 657 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove credential placeholders that are intended to be replaced directly in the source file. 2. Read credentials from environment variables or a dedicated secret-management system, and terminate with an error when required values are absent. 3. If a configuration file is necessary, keep it outside the repository, add it to ignore rules, and restrict its permissions to the owning user, such as mode `0600`. 4. Avoid placing secrets directly in process arguments. Construct the JSON safely and pass it to `curl` through standard input: ```bash #!/usr/bin/env bash set -euo pipefail : "${CD_API_KEY:?CD_API_KEY is required}" : "${CD_TEL:?CD_TEL is required}" : "${CD_IMEI:?CD_IMEI is required}" URL="https://www.cd6969.com/admin.php?s=/Admin/ApiV2/getList.html" response=$( jq -n \ --arg key "$CD_API_KEY" \ --arg tel "$CD_TEL" \ '{key: $key, tel: $tel}' | curl --fail-with-body --silent --show-error \ -X POST "$URL" \ -H "Content-Type: application/json" \ --data-binary @- ) ``` 5. Document secure secret provisioning rather than instructing users to edit the executable script. 6. Rotate any real API credentials that have previously been committed, archived, shared, or exposed through process or audit logs. ]]>