T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- tools/lastpass.sh:6
- Finding
- Unrestricted Retrieval and Raw Disclosure of LastPass Vault Records<![CDATA[ ## Vulnerability Details **File Location**: `tools/lastpass.sh:6-28` **Vulnerability Type**: Missing least-privilege restrictions on credential retrieval **Risk Level**: Medium ### Vulnerable Code ```bash cmd="${1:-}" name="${2:-}" field="${3:-password}" if [[ "$cmd" != "get" || -z "$name" ]]; then echo "Usage: lastpass.sh get \"<name>\" [password|username|notes|raw]" >&2 exit 1 fi case "$field" in password) lpass show --password "$name" ;; username) lpass show --username "$name" ;; notes) lpass show --notes "$name" ;; raw) lpass show "$name" ;; *) echo "Unknown field: $field" >&2 exit 1 ;; esac ``` The corresponding interface documentation explicitly exposes raw-record retrieval in `SKILL.md:20-21,29`: ```json { "name": "Exact LastPass entry name", "field": "password | username | notes | raw" } ``` ### Technical Analysis The wrapper accepts an arbitrary caller-controlled LastPass entry name and allows retrieval of passwords, usernames, secure notes, or the entire raw record. It does not enforce an entry allowlist, workflow-specific scope, purpose validation, or user confirmation before accessing sensitive fields. The `raw` option is particularly broad because `lpass show "$name"` can return the complete vault record rather than only the field required by the current operation. Any agent authorized to invoke this Skill therefore inherits read access to records available through the active `lpass` session, including records unrelated to the legitimate automation task. Secrets are also returned directly through standard output. Returning a requested value is intrinsic to the declared functionality, but plaintext output can be captured in agent transcripts, orchestration logs, command output, or downstream tool calls unless the execution environment applies secret-aware handling. The project contains no explicit network request, external destination, or exfiltration routine. Any sy ...[truncated 1468 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `raw` retrieval mode unless a documented workflow strictly requires complete-record access. 2. Restrict retrieval to an allowlist of approved vault entries and fields associated with each workflow. 3. Require explicit user confirmation before returning passwords, secure notes, or complete records. 4. Run the Skill using a dedicated LastPass identity or shared folder containing only the credentials required by the automation. 5. Mark tool output as sensitive and prevent it from being stored in logs, conversation history, telemetry, or persistent agent memory. 6. Prefer passing secrets through protected process channels or secret references rather than displaying them in general-purpose stdout where supported. 7. Add an auditable authorization layer that records the requested entry, requested field, requesting workflow, and approval decision without recording the secret itself. 8. If supported by the deployed `lpass` version, place `--` before the caller-controlled entry name to ensure it cannot be interpreted as an additional command-line option. ]]>