T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/utils.py:88- Finding
CRM Data Is Stored Without Restrictive Filesystem Permissions
- Content
View full analysis
None: """将数据写入 JSON 文件。 Args: filepath: 目标文件路径。 data: 待写入的数据。 """ os.makedirs(os.path.dirname(filepath), exist_ok=True) with open(filepath, "w", encoding="utf-8") as f: json.dump(data, f, ensure_ascii=False, indent=2, default=str) ``` ### Technical Analysis The application stores customer records and follow-up data as unencrypted JSON. These records can contain names, full phone numbers, companies, budgets, product interests, and commercially sensitive follow-up notes. The function creates the parent directory and output file without explicitly applying restrictive permissions. Their effective permissions therefore depend on the process umask and the permissions of an existing directory. In an environment with a permissive umask or pre-created shared data directory, other local users or processes may be able to read CRM data. The issue also affects custom storage locations supplied through `CP_DATA_DIR`. The code does not verify whether that directory is private, owned by the current user, a symbolic link, or accessible by other users. ### Attack Path 1. The Skill runs with a permissive umask or with `CP_DATA_DIR` pointing to a shared or insufficiently protected directory. 2. A user adds customer records or follow-up notes. 3. `write_json_file` creates or updates `customers.json` and `followups.json` without enforcing private permissions. 4. Another local account or process with filesystem access to that directory opens the files. 5. The attacker obtains the stored customer identities, phone numbers, budgets, sales status, and follow-up content. This path requires local filesystem access and an environment in which the ...[truncated 692 chars]- Remediation
View remediation