T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/pushover_send.js:40
- Finding
- Pushover Credentials Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/pushover_send.js`, lines 40–44 **Vulnerability Type**: Command-line secret exposure **Risk Level**: Medium ### Vulnerable Code ```js const token = process.env.PUSHOVER_APP_TOKEN || process.env.PUSHOVER_TOKEN || args.token; const user = process.env.PUSHOVER_USER_KEY || process.env.PUSHOVER_USER || args.user; if (!token) die("Missing Pushover app token. Set PUSHOVER_APP_TOKEN (or pass --token)."); if (!user) die("Missing Pushover user key. Set PUSHOVER_USER_KEY (or pass --user)."); ``` ### Technical Analysis The script permits the Pushover application token and user key to be supplied through the `--token` and `--user` command-line arguments. Process arguments are not an appropriate secret-transport mechanism because they may be exposed through process inspection, shell history, job metadata, monitoring systems, audit logs, and diagnostic output. Environment variables are preferred by the documentation, but the executable explicitly supports and advertises the unsafe command-line fallback. Exploitation requires the victim to invoke the script using these options and the attacker to have access to a process-listing, command-history, or logging source that records the invocation. ### Attack Path 1. A user or automated job invokes the script with credentials, for example: ```bash node scripts/pushover_send.js \ --token SECRET_APP_TOKEN \ --user SECRET_USER_KEY \ --message "Test" ``` 2. The full command line is retained in shell history, job metadata, process monitoring, audit telemetry, or diagnostic logs, or is observed while the process is running. 3. A local user or service with access to that data recovers the application token and user key. 4. The attacker submits requests directly to the Pushover Messages API using the recovered credentials. 5. The attacker sends unauthorized notifications to the associated Pushover account, subject to the permissions and limits of the compr ...[truncated 593 chars]
- Remediation
- ## Remediation Suggestions 1. Remove support for the `--token` and `--user` command-line options. 2. Remove error messages that recommend passing credentials through command-line arguments. 3. Obtain credentials only through a protected secret-injection mechanism, such as: - Environment variables supplied by a trusted runtime secret store. - A dedicated secrets manager. - A credential file restricted to the owning account, with permissions such as `0600`. 4. Fail securely when the approved credential source is unavailable. 5. Ensure operational logs and exception handlers never include credential values. 6. Update usage documentation to explicitly prohibit command-line credentials. 7. Rotate any credentials previously supplied through command-line arguments if they may have been retained in shell history, process telemetry, or logs. A hardened implementation should use only approved secret sources: ```js const token = process.env.PUSHOVER_APP_TOKEN; const user = process.env.PUSHOVER_USER_KEY; if (!token) die("Missing Pushover app token. Set PUSHOVER_APP_TOKEN."); if (!user) die("Missing Pushover user key. Set PUSHOVER_USER_KEY."); ```