T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/vault.js:34
- Finding
- Vault credentials and cached secrets are stored without restrictive file permissions## Vulnerability Details **File Location**: `scripts/vault.js:34-36` and `scripts/vault.js:87-89` **Vulnerability Type**: Insecure storage of sensitive information **Risk Level**: High ### Vulnerable Code Configuration writing at `scripts/vault.js:34-36`: ```js function saveConfig(cfg) { fs.mkdirSync(path.dirname(CONFIG_PATH), { recursive: true }); fs.writeFileSync(CONFIG_PATH, JSON.stringify(cfg, null, 2)); } ``` Cache writing at `scripts/vault.js:87-89`: ```js function saveCache(cache) { fs.writeFileSync(CACHE_PATH, JSON.stringify(cache, null, 2)); } ``` ### Technical Analysis The configuration file contains the Vault authentication token, and the cache file contains complete plaintext secret values retrieved from Vault. Both files are written without an explicit restrictive mode such as `0600`. Node.js therefore creates these files using permissions derived from the process umask. In environments with a permissive or incorrectly configured umask, other local users or processes may be able to read the files. The code also does not inspect or repair the permissions of existing files. The cache increases the exposure scope because retrieved API keys, database credentials, and other secrets remain on disk until manually removed, even after their configured cache expiration time. Cache expiration only prevents the application from using stale entries; it does not erase expired values from the file. ### Attack Path 1. A user runs `vault.js setup`, causing the Vault token to be written to `~/.openclaw/vault.json`. 2. The user runs `vault.js get`, causing retrieved secret values to be written to `~/.openclaw/vault-cache.json`. 3. The files are created under the permissions allowed by the ambient process umask. 4. Another local account or compromised process reads one or both files if their resulting permissions permit access. 5. The attacker directly uses cached credentials or submits the stolen V ...[truncated 746 chars]
- Remediation
- ## Remediation Suggestions - Create both sensitive files with owner-only permissions: ```js fs.writeFileSync(CONFIG_PATH, JSON.stringify(cfg, null, 2), { mode: 0o600 }); fs.writeFileSync(CACHE_PATH, JSON.stringify(cache, null, 2), { mode: 0o600 }); ``` - Apply `fs.chmodSync(file, 0o600)` after writing so existing files with unsafe permissions are repaired. - Ensure `~/.openclaw` is accessible only to its owner, preferably with mode `0700`. - Use atomic writes through a securely created temporary file in the same protected directory, followed by a rename. - Refuse or safely handle symbolic links to reduce the risk of writing sensitive data to an unintended target. - Consider disabling persistent secret caching by default. If caching is required, remove expired entries from disk and provide a command that securely clears the cache. - Where feasible, store the Vault token through an operating-system credential store or secret service rather than a plaintext JSON file.