T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/karakeep-cli.py:27
- Finding
- API Key Stored in a Plaintext Configuration File Without Explicit Permission Hardening## Vulnerability Details **File Location**: `scripts/karakeep-cli.py`, lines 27-31 **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Medium ### Vulnerable Code ```python def save_config(url, api_key): config_path = os.path.expanduser("~/.config/karakeep/config.json") os.makedirs(os.path.dirname(config_path), exist_ok=True) with open(config_path, 'w') as f: json.dump({"url": url, "api_key": api_key}, f) ``` ### Technical Analysis The `login` command persists the Karakeep API key directly in a plaintext JSON file. Neither the configuration directory nor the file is created with an explicit owner-only permission mode. Consequently, their effective permissions depend on the invoking process's `umask` and any preexisting directory or file permissions. The code also writes directly to the destination file rather than creating a restricted temporary file and atomically replacing the configuration. Although no race-condition exploit is confirmed from the available code alone, direct writes make robust permission and integrity handling more difficult. ### Attack Path 1. A user invokes the documented `login` command with a valid Karakeep API key. 2. `save_config()` writes that key to `~/.config/karakeep/config.json` as plaintext. 3. On a system with a permissive `umask`, inherited ACL, or preexisting broadly readable configuration file, another local account or process reads the file. 4. The attacker extracts the `api_key` and associated instance URL. 5. The attacker uses the stolen bearer credential against the Karakeep API. ### Impact Assessment Exploitation requires local read access to the configuration file, such as access through another local account, a compromised process, an overly broad ACL, or a backup process that exposes the file. It does not directly grant operating-system privilege escalation. A stolen API key may allow the attacker to exercise all Karak ...[truncated 340 chars]
- Remediation
- ## Remediation Suggestions - Create `~/.config/karakeep` with owner-only permissions, such as mode `0700`. - Create the configuration file with mode `0600` using an API that applies the restrictive mode at file creation time. - Verify and repair permissions on an existing configuration file before writing credentials. - Write through a securely created temporary file in the same directory, flush it, apply mode `0600`, and atomically replace the destination. - Prefer an operating-system credential manager or keyring rather than storing the API key in JSON. - Document that environment variables can also be exposed to other processes or diagnostic tooling and should not be treated as a complete secret-management solution. - Consider supporting short-lived, narrowly scoped API tokens to reduce the impact of credential disclosure.