T09 · Insecure Skill Coding Practices
Error
- Location
- references/platform-script-templates.txt:121
- Finding
- Mass Credential Disclosure and Weak Password Reset## Vulnerability Details **File Location**: `references/platform-script-templates.txt`, lines 121–133 **Vulnerability Type**: Plaintext credential exposure and insecure account modification **Risk Level**: Critical ### Vulnerable Code ```groovy def 账号数据 = DataModelUtils.getCIByAttr("gdmp_account") for(aa in 账号数据){ if(aa.dataFieldMap.accountNo != "admin" && aa.dataFieldMap.accountNo != "guest"){ def 原始账号 = aa.dataFieldMap.accountNo println "原始账号==" + 原始账号 def 原始密码 = aa.dataFieldMap.password println "原始密码==" + 原始密码 def 修改密码 = "123456" println "修改密码==" + 修改密码 aa.dataFieldMap.password = 修改密码 DataModelUtils.saveCi(aa) } } ``` ### Technical Analysis The listener template retrieves every record from the platform account table, reads the existing password field, and prints that password to application logs. It then replaces the password of every account except `admin` and `guest` with the same hardcoded value, `123456`. This violates credential confidentiality and password-storage best practices. If the password field contains plaintext or reversible values, the original credentials become available to anyone with log access. Independently, assigning one predictable password to many accounts creates a platform-wide credential compromise. Excluding two accounts does not protect the remaining users. Although this code is distributed as a template rather than an automatically executed package script, `SKILL.md` explicitly directs the Agent to read and reuse this reference when generating platform scripts. ### Attack Path 1. An attacker requests a platform listener script based on the bundled listener example or convinces an operator to deploy it. 2. The generated listener executes with access to the `gdmp_account` data model. 3. It enumerates all account records and writes original password values to logs. 4. ...[truncated 829 chars]
- Remediation
- ## Remediation Suggestions - Remove the credential-reading and mass password-reset example from the reference file. - Never print password fields, password hashes, reset tokens, or other authentication material. - Do not access password columns through generic data-model APIs. - Route password changes through a dedicated, authenticated password-reset service. - Require explicit authorization and target one identified account per administrative operation. - Enforce strong password policy and generate a unique reset secret for each account. - Store passwords only as salted, computationally expensive hashes. - Require the user to replace temporary credentials immediately and invalidate active sessions after a reset. - Review existing logs for exposed credentials, securely purge affected records where permitted, rotate exposed credentials, and notify affected users. - Add a security test or static-analysis rule that rejects scripts reading, logging, or directly assigning account password fields.