T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:66
- Finding
- RTSP Credentials Exposed in Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 66–67 **Vulnerability Type**: Plaintext credential exposure through command-line arguments **Risk Level**: Medium ### Vulnerable Code ```bash ros2 launch hobot_rtsp_client hobot_rtsp_client.launch.py \ rtsp_url:="rtsp://admin:password@192.168.1.64:554/stream1" ``` ### Technical Analysis The RTSP example embeds a username and password directly in the URL passed as a command-line argument. Although the values appear to be illustrative, users may replace them with operational credentials while following the documentation. Credentials supplied this way can be exposed through: - Shell history files. - Process listings and `/proc` process metadata while the command is running. - ROS launch diagnostics or application logs. - Terminal recordings, screenshots, and copied troubleshooting output. - Scripts or deployment records created from the documented example. The URL uses the unencrypted `rtsp://` scheme. Unless the underlying media session is separately protected, credentials and video traffic may also be exposed to interception on an untrusted network. ### Attack Path 1. A user substitutes valid camera credentials into the documented RTSP URL. 2. The user executes the ROS 2 launch command. 3. The credentials are retained in shell history, exposed in process arguments, or recorded in logs and diagnostic output. 4. An attacker with access to the same host, its logs, terminal records, or relevant network traffic retrieves the credentials. 5. The attacker authenticates to the RTSP device using the disclosed account. 6. The attacker accesses camera streams or other device functions permitted by that account. ### Impact Assessment Successful exploitation can disclose the RTSP account credentials and permit unauthorized access within the privileges assigned to that account. Likely consequences include unauthorized viewing of camera streams, privacy loss, surveillance, and access to addit ...[truncated 479 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not place real credentials directly in command-line arguments or URLs. - Replace the example credentials with unmistakable placeholders and add an explicit warning not to enter production secrets directly on the command line. - Use a client-supported secure credential mechanism, such as an interactive password prompt, protected credential file, secret store, or environment/file-descriptor integration that does not expose the secret in process arguments. - Restrict any credential file to the service account that requires it, for example with owner-only permissions, and exclude it from version control and diagnostic bundles. - Configure ROS nodes and launch tooling to redact URLs containing user information before writing logs. - Disable or carefully manage shell history when sensitive commands cannot be avoided, while recognizing that this does not prevent exposure through process listings. - Prefer `rtsps://`, SRTP, a VPN, or another authenticated encrypted tunnel where supported. - Create a dedicated, least-privileged camera account for stream access rather than using an administrator account. - Rotate any credentials that may already have appeared in command histories, logs, screenshots, or shared troubleshooting records. ]]>