T09 · Insecure Skill Coding Practices
Warning
- Location
- msmtprc.md:2
- Finding
- Plaintext SMTP Application Password Storage Without Required File-Permission Hardening## Vulnerability Details **File Location**: `msmtprc.md`, lines 2 and 13 **Vulnerability Type**: Plaintext credential storage and insecure configuration guidance **Risk Level**: Medium ### Vulnerable Code ```text # Fill out your details and place this file in ~/.msmtprc ``` ```text password abcd efgh ijkl mnop # Use the password from https://myaccount.google.com/apppasswords ``` ### Technical Analysis The configuration template directs users to replace a placeholder with a Gmail application password and store it directly in `~/.msmtprc`. Storing an authentication secret in plaintext creates a credential-exposure risk. The documentation also does not require restrictive permissions such as mode `0600` or verify that the file is owned by the intended user. Consequently, a real application password may become accessible through permissive file permissions, local access by another account, insecure backups, or accidental inclusion in version control. This finding concerns the documented credential-handling pattern; the audited template itself contains only a placeholder, not a confirmed live credential. ### Attack Path 1. A user copies the template to `~/.msmtprc`. 2. The user replaces the sample value with a valid Gmail application password. 3. The file remains readable by unintended local users, is copied into an insecure backup, or is accidentally committed to a repository. 4. An attacker obtains the plaintext application password from the exposed file or copy. 5. The attacker authenticates to Gmail's SMTP service using the compromised account and application password. 6. The attacker sends unauthorized email within the permissions and restrictions associated with that application password. ### Impact Assessment Successful exploitation can disclose the configured Gmail application's SMTP credential. An attacker may send email as the affected account, enabling impersonation, spam, phishing, reputational ...[truncated 396 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer retrieving the password from an operating-system keyring or dedicated secret manager through msmtp's `passwordeval` directive instead of embedding it in the configuration file. 2. If file-based storage is unavoidable, explicitly require restrictive ownership and permissions: ```bash chown "$USER":"$(id -gn)" ~/.msmtprc chmod 600 ~/.msmtprc ``` 3. Add setup-time validation that rejects configuration files readable or writable by group or other users. 4. Clearly identify the displayed password as a non-secret placeholder and warn users never to commit a populated `.msmtprc` to version control. 5. Exclude credential-bearing configuration files from backups unless the backups are encrypted and access-controlled. 6. Rotate the Gmail application password immediately if the populated file is exposed, committed, or copied to an untrusted location.