T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/send.py:23
- Finding
- SMTP Password Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/send.py`, line 23 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```python parser.add_argument("--smtp-pass", default=os.getenv("SMTP_PASS"), help="SMTP password") ``` ### Technical Analysis The script permits an SMTP password to be supplied through the `--smtp-pass` command-line argument. Command-line arguments are not an appropriate secret-transport mechanism because they may be: - Stored in shell history. - Captured by command auditing or process-monitoring systems. - Visible in process metadata to local users or services, subject to operating-system access controls. - Recorded in automation logs, diagnostic output, or job definitions. Although the environment-variable default provides a safer alternative in some deployment contexts, the exposed command-line interface explicitly supports unsafe credential handling. The error message at line 35 also directs users to provide missing configuration through “environment variables or arguments,” potentially encouraging this behavior. ### Attack Path 1. A user invokes the script with a plaintext credential, for example: ```bash python3 scripts/send.py \ --smtp-server smtp.example.com \ --smtp-user user@example.com \ --smtp-pass 'SECRET' \ --to-email recipient@example.com \ --subject Test \ --body Message ``` 2. The password becomes part of the process argument vector and may also be retained in shell history or execution logs. 3. A local attacker, monitoring service, log reader, or other party with suitable access retrieves the exposed argument. 4. The attacker authenticates to the configured SMTP service using the recovered credential. 5. The attacker sends unauthorized messages or performs any additional operations permitted by that SMTP account. Exploitation requires access to pro ...[truncated 682 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `--smtp-pass` command-line option so secrets cannot be supplied through process arguments. 2. Retrieve the password from a protected secret manager or, where appropriate, the `SMTP_PASS` environment variable. 3. For interactive execution, use `getpass.getpass()` to accept the password without displaying or persisting it in shell history. 4. Update the error message at line 35 so it does not recommend supplying the password through arguments. 5. Ensure automation platforms mask the secret, restrict access to job configuration and logs, and avoid printing environment contents. 6. Use provider-specific, narrowly scoped app passwords rather than primary account credentials, and rotate any credential previously passed on the command line.