T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/lib/env.py:35
- Finding
- Automatic Reuse of Ambient Codex and Browser Session Credentials<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/env.py:35-37, 89-151`; `scripts/lib/vendor/bird-search/lib/cookies.js:72-89, 121-159` **Vulnerability Type**: Automatic access to ambient account credentials beyond dedicated Skill secrets **Risk Level**: Medium ### Vulnerable Code ```python CODEX_AUTH_FILE = Path(os.environ.get("CODEX_AUTH_FILE", str(Path.home() / ".codex" / "auth.json"))) ``` ```python def load_codex_auth(path: Path = CODEX_AUTH_FILE) -> Dict[str, Any]: """Load Codex auth JSON.""" if not path.exists(): return {} try: with open(path, "r") as f: return json.load(f) except Exception: return {} def get_codex_access_token() -> tuple[Optional[str], str]: """Get Codex access token from auth.json. Returns: (token, status) where status is 'ok', 'missing', or 'expired' """ auth = load_codex_auth() token = None if isinstance(auth, dict): tokens = auth.get("tokens") or {} if isinstance(tokens, dict): token = tokens.get("access_token") if not token: token = auth.get("access_token") if not token: return None, AUTH_STATUS_MISSING if _token_expired(token): return None, AUTH_STATUS_EXPIRED return token, AUTH_STATUS_OK def get_openai_auth(file_env: Dict[str, str]) -> OpenAIAuth: """Resolve OpenAI auth from API key or Codex login.""" api_key = os.environ.get('OPENAI_API_KEY') or file_env.get('OPENAI_API_KEY') if api_key: return OpenAIAuth( token=api_key, source=AUTH_SOURCE_API_KEY, status=AUTH_STATUS_OK, account_id=None, codex_auth_file=str(CODEX_AUTH_FILE), ) codex_token, codex_status = get_codex_access_token() if codex_token: account_id = extract_chatgpt_account_id(codex_token) if account_id: return OpenAIAuth( token=codex_token, ...[truncated 4652 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit opt-in before reading `~/.codex/auth.json` or any browser credential store. 2. Default to dedicated, revocable API keys stored in the Skill's mode-`0600` secrets file. 3. Add flags such as `LAST30DAYS_ALLOW_CODEX_AUTH=1` and `LAST30DAYS_ALLOW_BROWSER_COOKIES=1`, with both disabled by default. 4. Clearly document all credential paths, fallback behavior, recipient domains, and authorization implications in the primary `SKILL.md`. 5. Allow the user to select a specific browser and profile rather than probing Safari, Chrome, and Firefox automatically. 6. Isolate browser-cookie access in a minimal helper with narrowly restricted filesystem and network permissions. 7. Avoid exposing raw credentials to child processes where possible; pass them through a protected IPC mechanism or a dedicated credential broker. 8. Provide a diagnostic mode that reports credential availability without reading or returning credential values. 9. Pin and verify the integrity of the browser-cookie dependency and review updates before deployment. ]]>