T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- twitter_cli/auth.py:114
- Finding
- Excessive Collection and Transmission of Complete Browser Cookie Sets## Vulnerability Details **File Location**: `SKILL.md:70-79`, `twitter_cli/auth.py:114-132`, `twitter_cli/auth.py:204-221`, `twitter_cli/auth.py:292-300`, `twitter_cli/client.py:878-882` **Vulnerability Type**: Excessive credential access and transmission beyond least privilege **Risk Level**: High ### Vulnerable Code `SKILL.md:77-80` instructs the Agent to place a user-provided complete cookie string into a shell variable: ```bash FULL_COOKIE="user-provided complete cookie string" export TWITTER_AUTH_TOKEN=$(echo "$FULL_COOKIE" | grep -oE 'auth_token=[a-f0-9]+' | cut -d= -f2) export TWITTER_CT0=$(echo "$FULL_COOKIE" | grep -oE 'ct0=[a-f0-9]+' | cut -d= -f2) twitter whoami ``` `twitter_cli/auth.py:114-132` collects every cookie associated with X or Twitter domains: ```python def _extract_cookies_from_jar(jar: Any, source: str = "unknown") -> Optional[Dict[str, str]]: """Extract Twitter cookies from a cookie jar.""" result: Dict[str, str] = {} all_cookies: Dict[str, str] = {} twitter_cookie_count = 0 for cookie in jar: domain = cookie.domain or "" if _is_twitter_domain(domain): twitter_cookie_count += 1 if cookie.name == "auth_token": result["auth_token"] = cookie.value elif cookie.name == "ct0": result["ct0"] = cookie.value if cookie.name and cookie.value: all_cookies[cookie.name] = cookie.value if "auth_token" in result and "ct0" in result: cookies = {"auth_token": result["auth_token"], "ct0": result["ct0"]} if all_cookies: cookies["cookie_string"] = "; ".join("%s=%s" % (k, v) for k, v in all_cookies.items()) logger.info("Extracted %d total cookies for full browser fingerprint", len(all_cookies)) return cookies ``` `twitter_cli/client.py:878-882` transmits the resulting complete cookie string in authenti ...[truncated 2821 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction asking users to send complete cookie headers through an Agent conversation. 2. Accept credentials only through local, non-echoing input, a permission-restricted credential file, an operating-system secret store, or environment injection performed outside the conversation. 3. Replace the unrestricted `all_cookies` collection with an explicit allowlist of cookie names proven necessary for each API operation. 4. Default to transmitting only `auth_token` and `ct0`. If additional cookies are demonstrably required, document and allowlist each one individually. 5. Separate read-only and write-capable authentication modes where feasible, using the least privileged mode for status and read commands. 6. Ensure verbose logging never prints cookie names and values, request headers, or proxy URLs containing credentials. 7. Clear temporary secret variables immediately after use and document shell-history-safe credential setup. 8. Add tests asserting that unrelated browser cookies never appear in the generated `Cookie` request header.