T09 · Insecure Skill Coding Practices
Error
- Location
references/REFERENCE.md:7- Finding
Predictable SearXNG Secret Caused by Quoted Heredoc
- Content
View full analysis
searxng/settings.yml << 'EOF' use_default_settings: true server: secret_key: "$(openssl rand -hex 32)" bind_address: "0.0.0.0" port: 8080 limiter: false image_proxy: true search: safe_search: 0 default_lang: "all" formats: - html - json EOF ``` ### Technical Analysis The heredoc delimiter is single-quoted (`<< 'EOF'`), which disables shell expansion throughout the heredoc. Consequently, `$(openssl rand -hex 32)` is not executed. The generated `settings.yml` contains the literal, publicly documented value: ```yaml secret_key: "$(openssl rand -hex 32)" ``` This results in every deployment following these instructions receiving the same predictable secret rather than a cryptographically random value. Security controls that depend on the SearXNG server secret may therefore operate with a known key. ### Attack Path 1. An administrator follows the documented quick-deployment procedure. 2. The quoted heredoc writes the literal command substitution into `settings.yml`. 3. The SearXNG container starts with the predictable, publicly known secret. 4. An attacker who can reach the instance identifies that it was deployed using this guide. 5. The attacker uses knowledge of the secret when targeting server functionality whose integrity depends on that key. The exact exploitable server operations depend on the installed SearXNG version and how it uses `server.secret_key`, but the secret cannot be treated as confidential or deployment-specific. ### Impact Assessment The issue does not directly grant host or container privileges. It weakens application-level trust boundaries by deploying a known server secret. Potentially affected scope includes sessions, signed values, request-integrity controls, or other SearXNG features that derive securit ...[truncated 26 chars]- Remediation
View remediation
&2 exit 1 } cat > searxng/settings.yml << EOF use_default_settings: true server: secret_key: "$SECRET_KEY" bind_address: "0.0.0.0" port: 8080 limiter: true image_proxy: true search: safe_search: 0 default_lang: "all" formats: - html - json EOF ``` Alternatively, retain a quoted heredoc with a conspicuous placeholder and add a separate, validated replacement operation. The deployment procedure should fail if the resulting value is empty, unchanged, or equal to a documented placeholder. Restrict the resulting configuration file to the service owner where supported. ]]>