T09 · Insecure Skill Coding Practices
Error
- Location
- lib/query.py:16
- Finding
- Hard-Coded Shared CMDB Credentials<![CDATA[ ## Vulnerability Details **File Location**: `lib/query.py:16-19`; duplicated in `SKILL.md:14-18` **Vulnerability Type**: Hard-coded plaintext credentials **Risk Level**: High ### Vulnerable Code ```python # 配置 BASE_URL = "https://10.255.227.233/cmdb/v1/api" USERNAME = "openclaw_read" PASSWORD = "JzXCxTaDxE" ``` The same credentials are also disclosed in the Skill documentation: ```markdown ## 认证方式 通过 username/password 获取 Token，Token 有效期 8 小时。 - **登录接口**: `POST /cmdb/v1/api/oauth/token` - **用户名**: `openclaw_read` - **密码**: `JzXCxTaDxE` ``` ### Technical Analysis A reusable CMDB username and password are stored directly in both executable source code and documentation. Any person or system able to obtain the Skill package can recover the credentials without additional privileges. The credentials are submitted to the token endpoint to obtain an authentication token valid for eight hours. Because the account is shared and the secret is bundled with the Skill, access cannot be reliably attributed to an individual user. Repository history, package mirrors, backups, logs, and prior distributed copies may continue to expose the password even after it is removed from the current files. ### Attack Path 1. An attacker obtains a copy of the Skill package or reads its source. 2. The attacker extracts the `openclaw_read` username and plaintext password. 3. From a system with network access to the internal CMDB, the attacker sends the credentials to `/cmdb/v1/api/oauth/token`. 4. The attacker receives an eight-hour token. 5. The token is used to query asset models available to the shared account. 6. The attacker enumerates sensitive infrastructure records within the account's server-side permissions. ### Impact Assessment Successful exploitation can grant unauthorized access to the CMDB data readable by the shared account. Potentially exposed information includes host inventories, internal addresses, applications, databases, network resources, security g ...[truncated 437 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the exposed CMDB password. Treat it as compromised because it appears in distributed Skill content. 2. Remove the username and password from source code, documentation, examples, repository history, release artifacts, and cached package copies. 3. Retrieve credentials at runtime from an approved secret manager or protected environment variables. 4. Prefer short-lived, workload-specific credentials over a shared static password. 5. Assign a separate service identity to this Skill and restrict it to explicitly approved asset models and fields. 6. Add automated secret scanning to development and release pipelines. 7. Review CMDB authentication and query logs for use of the exposed account from unexpected systems or at unexpected times. 8. Ensure exceptions and diagnostic output never include passwords, tokens, or complete authentication responses. ]]>