T09 · Insecure Skill Coding Practices
Error
- Location
- move_to_exports.py:8
- Finding
- Hard-Coded Yahoo Mail App Password## Vulnerability Details **File Location**: `move_to_exports.py`, lines 8-23 **Vulnerability Type**: Hard-coded authentication credential **Risk Level**: High ### Vulnerable Code ```python HOST = "imap.mail.yahoo.com" # EDIT THIS: Your Yahoo Mail email address EMAIL = "your-email@yahoo.com" PASS = "zgvpnfymmwxebpof" EXPORT_FOLDERS = ["export1", "export2", "export3"] BATCH = 1000 # messages per MOVE call def count(m, folder): typ, data = m.status(f'"{folder}"', '(MESSAGES)') if typ == 'OK' and data: match = re.search(r'MESSAGES (\d+)', str(data)) if match: return int(match.group(1)) return 0 m = imaplib.IMAP4_SSL(HOST, 993) m.login(EMAIL, PASS) ``` ### Technical Analysis The script embeds a Yahoo-style app password directly in source code. Anyone who can read the distributed package, repository, backup, build artifact, or source history can recover the credential without accessing a dedicated secret store. The password is supplied to Yahoo through an encrypted IMAP connection, so this is not evidence of covert exfiltration or plaintext network transmission. The vulnerability is the credential's exposure at rest in source code. Although the included account address is a placeholder, the credential could still be abused if an attacker identifies its associated account through repository history, logs, other configuration, or credential reuse. ### Attack Path 1. An attacker obtains a copy of the project or its source history. 2. The attacker reads `move_to_exports.py` and extracts the embedded password. 3. The attacker identifies the corresponding Yahoo address from related configuration, logs, documentation, or prior revisions. 4. The attacker attempts authentication against Yahoo Mail using the exposed app password. 5. If the credential remains active, the attacker can exercise the mailbox permissions granted to that app password. ### Impact Assessment Successful ...[truncated 432 chars]
- Remediation
- ## Remediation Suggestions 1. Revoke and rotate the exposed Yahoo app password immediately. 2. Remove the credential from the current source and all repository history. 3. Load credentials from a protected environment variable or operating-system secret store: ```python EMAIL = os.environ["YAHOO_EMAIL"] password = os.environ["YAHOO_PASSWORD"] ``` 4. Fail closed when either variable is absent; do not provide literal credential fallbacks. 5. Restrict secret-file permissions if environment injection is performed through a file. 6. Add automated secret scanning to pre-commit and CI workflows. 7. Review Yahoo account access history for unauthorized sessions.