T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/reboot-alert.sh:21
- Finding
- Telegram Bot Token Exposed Through Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/reboot-alert.sh`, lines 21–34 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash BOT_TOKEN=$(grep "^BOT_TOKEN=" "$CONFIG_FILE" 2>/dev/null | cut -d= -f2) CHAT_ID=$(grep "^CHAT_ID=" "$CONFIG_FILE" 2>/dev/null | cut -d= -f2) [ -z "$BOT_TOKEN" ] || [ -z "$CHAT_ID" ] && exit 1 # Wait for network for i in $(seq 1 10); do curl -s --connect-timeout 3 https://api.telegram.org > /dev/null 2>&1 && break sleep 3 done # Send alert curl -s --connect-timeout 10 --max-time 15 \ "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \ ``` ### Technical Analysis The script correctly stores Telegram credentials in a user-managed configuration file that is documented as requiring mode `0600`. However, it interpolates `BOT_TOKEN` into the URL passed to `curl`. Command-line arguments are commonly exposed through process inspection interfaces and may also be recorded by system auditing, process monitoring, diagnostic, or telemetry services. While the `curl` process is running, its argument vector contains the plaintext Telegram bot token. Access to process arguments depends on operating-system configuration. Same-user processes can commonly inspect one another, while privileged monitoring services and some multi-user configurations may expose the arguments more broadly. The short execution time reduces the opportunity for interactive observation but does not protect against automated monitoring. ### Attack Path 1. The user creates `~/.rr-reboot-config` and enables the documented `@reboot` cron integration. 2. A reboot causes `scripts/reboot-alert.sh` to execute. 3. The script reads `BOT_TOKEN` from the protected configuration file. 4. It starts `curl` with the token embedded in the request URL in the process argument vector. 5. A malicious same-user process, sufficiently privileged local process, or command-line auditi ...[truncated 853 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Keep the bot token out of the `curl` argument vector. Supply the request URL and form data through a protected `curl` configuration delivered over standard input, for example: ```bash curl -s --connect-timeout 10 --max-time 15 \ --config - > /dev/null 2>&1 <<EOF url = "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" data = "chat_id=${CHAT_ID}" data = "text=${MESSAGE}" EOF ``` Because standard input is not part of the process argument vector, this prevents ordinary process-list inspection from revealing the token. Before adopting this exact pattern, escape or validate configuration values so that user-controlled values cannot inject additional curl configuration directives. Additional hardening measures: 1. Validate that `~/.rr-reboot-config` is a regular file owned by the current user and is not group- or world-readable before loading it. 2. Restrict `BOT_TOKEN` and `CHAT_ID` to expected character sets. 3. Use `curl --fail --show-error` and reset state only after confirming a successful Telegram API response; otherwise, failed alerts may be permanently treated as delivered. 4. Avoid placing credentials in temporary files. If a temporary configuration is unavoidable, create it with `umask 077`, use a securely generated path, and remove it with a trap. 5. Rotate the Telegram bot token after remediation if process monitoring or local observation may already have captured it. ]]>