T09 · Insecure Skill Coding Practices
Warning
- Location
xhs_cli/cookies.py:58- Finding
Plaintext Session Cookies Are Created Before Restrictive Permissions Are Applied
- Content
View full analysis
None: """Save cookies to local storage with restricted permissions and TTL timestamp.""" cookie_path = get_cookie_path() payload = {**cookies, "saved_at": time.time()} cookie_path.write_text(json.dumps(payload, indent=2)) cookie_path.chmod(0o600) logger.debug("Saved cookies to %s", cookie_path) ``` ### Technical Analysis The application saves active Xiaohongshu browser cookies in plaintext. It creates or truncates `cookies.json` through `Path.write_text()` and only applies mode `0600` after the write completes. The file's initial permissions therefore depend on the process umask. With a permissive umask, another local user may be able to read the file between its creation and the subsequent `chmod()` call. If the process crashes, is terminated, or encounters an error before `chmod()` completes, the credential file may remain accessible with broader permissions. The operation is also non-atomic. A concurrent reader can potentially observe partially written data, and interruption can leave a truncated credential cache. Although the intended destination is `~/.xiaohongshu-cli/cookies.json`, the containing directory is created without explicitly enforcing mode `0700`. The cookies are authentication credentials capable of authorizing account reads and writes. Their local storage is part of the declared functionality, but creating the file before securing it is not necessary. ### Attack Path 1. A victim uses a multi-user system and has an authenticated Xiaohongshu browser session. 2. A local attacker monitors `~/.xiaohongshu-cli/` for creation or modification of `cookies.json`. 3. The victim runs `xhs login`, or an authenticated command automatically refreshes stale co ...[truncated 1306 chars]- Remediation
View remediation