T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/yt_auth.py:52
- Finding
- Unsafe Pickle Deserialization Enables Arbitrary Local Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/yt_auth.py`, lines 52-59 **Vulnerability Type**: Unsafe deserialization **Risk Level**: High ### Vulnerable Code ```python # Load saved token if it exists (supports both pickle and JSON) if TOKEN_FILE.exists(): logger.info("Loading saved credentials from %s", TOKEN_FILE) try: # Try pickle format first (local development) with open(TOKEN_FILE, "rb") as token: credentials = pickle.load(token) except (pickle.UnpicklingError, EOFError): ``` ### Technical Analysis The application passes the contents of the predictable `youtube_token.json` file to `pickle.load()`. Python pickle data is executable serialization rather than a safe data-only format. During deserialization, an attacker-controlled object can invoke arbitrary functions through methods such as `__reduce__`. The `.json` extension is also misleading because the application first treats the file as a pickle. The JSON fallback does not mitigate this issue: a valid malicious pickle will execute before any fallback occurs. Exploitation requires the attacker to create or replace `youtube_token.json`. Potential sources include another process with project-directory write access, an untrusted archive or CI artifact, a compromised workspace, or a malicious repository contribution that introduces the token file. ### Attack Path 1. The attacker obtains write access to the project root or controls an artifact copied into it. 2. The attacker creates a malicious pickle payload and saves it as `youtube_token.json`. 3. The user invokes YouTube posting or another operation that calls `get_authenticated_service()`. 4. The function opens the file and passes it to `pickle.load()`. 5. The pickle reconstruction routine invokes the attacker-selected Python callable. 6. Arbitrary code executes with the operating-system privileges and environment access of the Skill process. ### Impact Assessment Successful exploitation pr ...[truncated 625 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove pickle support completely; OAuth credentials do not require executable object serialization. 2. Store credentials in JSON and load them with the Google authentication library: ```python token_data = json.loads(TOKEN_FILE.read_text(encoding="utf-8")) credentials = Credentials.from_authorized_user_info( token_data, scopes=YOUTUBE_SCOPES, ) ``` 3. Reject files that are not valid JSON rather than attempting another serialization format. 4. Validate that expected fields and OAuth endpoints are present before constructing credentials. 5. Store the token outside the repository in a dedicated user configuration or secret-storage directory. 6. Apply restrictive permissions and reject symbolic links before reading the token. 7. Delete and rotate existing token files after deployment because an attacker may already have replaced or copied them. ]]>