T09 · Insecure Skill Coding Practices
- Location
scripts/floor_monitor.py:154- Finding
Discord Webhook Credential Exposure Through Exception Logging
- Content
View full analysis
Vulnerability Details
File Location:
scripts/floor_monitor.py, lines 154–160
Vulnerability Type: Sensitive credential exposure through error logging
Risk Level: MediumVulnerable Code:
python try: resp = requests.post(webhook_url, json=payload, timeout=10) resp.raise_for_status() log("Discord alert sent successfully.") return True except Exception as e: log(f"Discord alert error: {e}") return FalseTechnical Analysis
The script sends alert data to a Discord webhook URL and logs the raw exception if the request fails. A Discord webhook URL contains a secret token that authorizes messages to the associated channel.
Exceptions generated by the
requestslibrary may include the complete request URL in their string representation. For example, an HTTP error raised byraise_for_status()can identify the URL that returned the unsuccessful status. Consequently, the exception logged to standard error may contain the webhook credential.This behavior is not necessary for the declared alert functionality and violates least-disclosure principles. The alert request itself is expected and user-enabled, but exposing its authentication URL in logs exceeds the minimum information required for diagnostics.
Attack Path
- A user configures a Discord webhook through
--discord-webhookorDISCORD_WEBHOOK_URL. - An alert condition is triggered while the
--discordoption is enabled. - The webhook request fails because of an HTTP error, connectivity problem, proxy response, revoked webhook, or deliberately induced network failure.
- The broad exception handler converts the resulting exception to text.
- The script writes that text to standard error without sanitization.
- A party with access to process, CI/CD, agent, service, or centralized logging output obtains the complete webhook URL if it appears in the exception.
- The party uses the webhook token t ...[truncated 702 chars]
- A user configures a Discord webhook through
- Remediation
View remediation
Remediation Suggestions
-
Do not log the raw exception where a credential-bearing URL may be attached. Emit a fixed diagnostic message and, if needed, the exception class:
python except requests.RequestException as exc: log(f"Discord alert failed: {type(exc).__name__}") return False -
If HTTP status information is needed, log only a sanitized numeric status code:
python except requests.HTTPError as exc: status = exc.response.status_code if exc.response is not None else "unknown" log(f"Discord alert failed with HTTP status {status}") return False except requests.RequestException as exc: log(f"Discord alert failed: {type(exc).__name__}") return False -
Never include the webhook URL, request headers, response body, or serialized request object in diagnostics.
-
Validate webhook destinations before transmission:
- Require HTTPS.
- Restrict the hostname to approved Discord webhook domains.
- Reject URLs containing unexpected user information, fragments, or malformed paths.
- Disable redirects or revalidate every redirect destination to prevent alert data from being forwarded to an unintended host.
-
Treat existing logs as potentially compromised. Search retained logs for Discord webhook URL patterns, restrict log access, remove exposed values where feasible, and revoke and regenerate any webhook whose URL may have been recorded.
-
Prefer runtime secret injection through a protected environment or secret manager, and ensure command-line arguments containing webhook URLs are discouraged because command lines may be visible in process listings and execution logs.
-