T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/api_inspect.py:291
- Finding
- Grafana API Key Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/api_inspect.py`, lines 291-292 **Vulnerability Type**: Command-line secret exposure **Risk Level**: Medium ```python grafana_url = sys.argv[1] api_key = sys.argv[2] ``` ### Technical Analysis The standalone command-line interface accepts the Grafana API key directly through `sys.argv`. Command-line arguments are not an appropriate secret transport mechanism because they may be recorded in shell history, process execution telemetry, audit logs, terminal logs, or automation-system logs. Depending on operating-system access controls, command arguments may also be observable through process-inspection interfaces while the program is running. The value is subsequently used as a bearer token for authenticated Grafana API requests. Although the code does not deliberately disclose the key, accepting it through a command argument unnecessarily exposes sensitive authentication material outside the process. ### Attack Path 1. An operator invokes `api_inspect.py` and supplies a valid Grafana API key as the second command-line argument. 2. The complete command may be retained in shell history, process metadata, audit records, or execution logs. 3. A local user, monitoring service, support operator, or compromised log collector with access to one of those sources retrieves the key. 4. The attacker submits the recovered key as a bearer token to the configured Grafana instance. 5. The attacker accesses every Grafana API operation and resource authorized to that key until it is revoked or expires. This path requires access to local process information, command history, or collected execution logs. It does not independently grant access beyond the permissions assigned to the exposed token. ### Impact Assessment A recovered key can provide authenticated access to the Grafana organization within the token's assigned privileges. For a recommended Viewer-level key, this may expose dashboard definitions, datasource metadat ...[truncated 425 chars]
- Remediation
- ## Remediation Suggestions 1. Remove support for supplying the API key as a command-line argument. 2. Read the key from a dedicated environment variable, such as `GRAFANA_API_KEY`, or from a secret manager. 3. For interactive execution, accept the key through a non-echoing prompt using Python's `getpass` module. 4. If configuration-file storage is supported, require restrictive file permissions and clearly warn users not to commit the file to source control. 5. Update usage documentation and examples so they never place credentials directly in command lines. 6. Fail securely when no credential is available rather than silently making unauthenticated requests. 7. Rotate any key that has already been used through command-line arguments if command histories or execution logs may be accessible. 8. Continue using a least-privilege Grafana service account token, preferably limited to Viewer permissions and only the required organization or resources.