T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/source-fetching-guide.md:11- Finding
Browser Proxy Credentials Extracted from Process Command Lines
- Content
View full analysis
> page.html` ``` ### Technical Analysis The guide instructs the Agent to inspect system-wide process command lines using `ps aux` and extract plaintext proxy credentials from a Chrome process. It then places those credentials directly into a `curl` command-line argument. Article retrieval does not inherently require discovering credentials from another process. The project already documents browser-based fetching as an alternative, so process-wide credential extraction exceeds the minimum access necessary for the Skill's declared functionality. Credentials supplied as command-line arguments can be exposed through: - Process-listing tools available to other local users or processes. - Shell history and terminal logging. - Agent execution transcripts and diagnostic output. - Monitoring or auditing systems that record process arguments. ### Attack Path 1. A user asks the Skill to process an article that ordinary fetching cannot retrieve. 2. The Agent follows the fallback procedure in `source-fetching-guide.md`. 3. The Agent executes `ps aux`, exposing command-line arguments for Chrome and potentially unrelated processes. 4. The regular expression extracts a SOCKS5 URL containing a plaintext username and password. 5. The Agent inserts the credentials into a `curl` command. 6. The credentials may be retained in process listings, command history, logs, or the Agent transcript. 7. Anyone with access to those records may reuse the proxy credentials for unrelated network traffic until they are revoked. ### Impact Assessment An attacker or u ...[truncated 514 chars]- Remediation
View remediation