T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/bilibili-garb-collection.sh:214
- Finding
- Bilibili access token exposed through the curl process command line## Vulnerability Details **File Location**: `scripts/bilibili-garb-collection.sh:214` **Vulnerability Type**: Authentication token disclosure through process arguments **Risk Level**: Medium **Vulnerable Code**: ```bash LOTTERY_RESPONSE=$(curl -s "https://api.bilibili.com/x/vas/dlc_act/lottery_home_detail?act_id=${ID}&lottery_id=${LOTTERY_ID}&mobi_app=iphone&platform=ios&appkey=${APPKEY}&access_key=${ACCESS_KEY}" 2>/dev/null) ``` ### Technical Analysis The script interpolates `BILI_ACCESS_KEY` into a URL passed directly as a command-line argument to `curl`. Although the request uses HTTPS and targets an official Bilibili endpoint, TLS only protects the request in transit. It does not conceal the command arguments on the local system. During execution, the complete URL—including the access token—may be exposed through process inspection facilities such as `/proc/<pid>/cmdline`, process-monitoring tools, audit services, diagnostic utilities, or command telemetry. URLs may also be retained by HTTP proxy or debugging infrastructure. ### Attack Path 1. A user exports a valid token in `BILI_ACCESS_KEY`. 2. The user invokes `bilibili-garb-collection.sh` for a collection containing a lottery ID. 3. Line 214 starts `curl` with the token embedded in its URL argument. 4. While the process is active, another local process or user with sufficient process-inspection access reads the curl command line. 5. The attacker extracts `access_key` from the captured URL. 6. The attacker reuses the token against Bilibili APIs until it expires or is revoked. Exploitation depends on local process-visibility controls and timing, but repeated invocations or process-monitoring software can make collection practical. ### Impact Assessment Disclosure grants possession of the affected Bilibili access token. The exact privileges depend on the token's account scope and Bilibili's server-side authorization controls. Pote ...[truncated 266 chars]
- Remediation
- ## Remediation Suggestions - Do not place authentication secrets in command-line arguments. - Prefer an API authentication method that accepts the token in an authorization header or protected request body, if supported by the endpoint. - If Bilibili requires `access_key` as a query parameter, replace the external `curl` invocation with an in-process HTTP client. This prevents the full URL from appearing in a separate process's argument vector. - Ensure application and proxy logs redact query parameters named `access_key`, `SESSDATA`, `csrf`, and `sign`. - Run the script under a dedicated, least-privileged account with restrictive process-visibility controls. - Rotate any token suspected of having been exposed.