T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_bookmarks.sh:32- Finding
X Session Credentials Exposed Through Process Arguments
- Content
View full analysis
&1 || true) ``` ### Technical Analysis The script passes `BIRD_AUTH_TOKEN` and `BIRD_CT0` directly to the `bird` CLI as command-line arguments. These values represent authentication material for the user's X account. Supplying the credentials to X is necessary for retrieving private bookmarks, but placing them in the process argument vector is not necessary and violates least-exposure principles. Depending on operating-system process isolation, `/proc` mount options, container configuration, and monitoring software, command-line arguments may be visible through facilities such as: ```bash ps aux ps -ef cat /proc//cmdline ``` The use of environment variables to initially obtain the secrets does not prevent this exposure because the values are subsequently copied into `bird`'s argument vector. ### Attack Path 1. The victim exports valid `BIRD_AUTH_TOKEN` and `BIRD_CT0` values. 2. The victim executes `scripts/fetch_bookmarks.sh`. 3. The script launches `bird` with both credentials embedded in its command line. 4. A malicious local user, compromised monitoring agent, or other process with access to process metadata observes the command line while `bird` is running. 5. The attacker extracts the credentials and reuses them to access X within the privileges and lifetime of the captured session. ### Impact Assessment Successful exploitation can disclose an authenticated X session. An attacker may gain access to private bookmark data and potentially other account operations permitted by the captured credentials. The exact scope depends on X's session controls and whether additional verification is required. This issue does not independently grant operating-system ...[truncated 94 chars]- Remediation
View remediation