T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/rcon_cmd.py:137
- Finding
- RCON Password Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/rcon_cmd.py:137-139` **Vulnerability Type**: Credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```python host = sys.argv[1] port = int(sys.argv[2]) password = sys.argv[3] ``` The documented invocation in `SKILL.md:86-89` also explicitly places the password on the command line: ```bash python3 scripts/rcon_cmd.py <host> <port> <password> <command> ``` ### Technical Analysis The RCON password is supplied through `argv`. Depending on the operating system and process-monitoring configuration, command-line arguments can be visible to other local users, administrators, monitoring agents, process accounting systems, diagnostic collectors, and CI/CD logs. If an operator types the documented command into an interactive shell, the complete command—including the plaintext password—may also be retained in shell history. Although the Python script does not print the password directly, reading it from `sys.argv[3]` causes the secret to cross multiple disclosure-prone interfaces before authentication occurs. ### Attack Path 1. An administrator invokes the script using the documented syntax and includes the RCON password in the command line. 2. The complete invocation is recorded in shell history, process telemetry, audit logs, or a process listing while the command is running. 3. A local user or service with access to one of those sources obtains the plaintext password. 4. The attacker connects to the configured game server's RCON port. 5. The attacker authenticates with the recovered password and executes any command permitted by the RCON service. ### Impact Assessment Successful exploitation exposes the server's RCON administrative credential. The attacker may execute privileged game-server commands, change maps and server settings, enable cheats, remove or ban players, disrupt active sessions, and invoke commands exposed by installed server pl ...[truncated 167 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the password positional argument from the command-line interface. - Prompt for the password using Python's `getpass.getpass()` so input is not echoed or stored in shell history. - Alternatively, read the secret from a permission-protected file descriptor or a dedicated secret-management system. - If a configuration file is used, require ownership by the executing user and mode `0600` before reading it. - Avoid exposing the password through environment variables where process or diagnostic tooling can inspect them. - Update all examples in `SKILL.md` so they no longer encourage placing credentials in command-line arguments. - Rotate any password that has previously been used with the documented invocation method. ]]>