T09 · Insecure Skill Coding Practices
- Location
scripts/linkedin-api.js:84- Finding
LinkedIn Session State Stored Without Restrictive File Permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/linkedin-api.js:84-89
Vulnerability Type: Insecure storage of reusable authentication material
Risk Level: HighVulnerable Code:
js saveSession() { if (this.context) { this.ensureConfigDir(); this.context.storageState().then(state => { fs.writeFileSync(SESSION_FILE, JSON.stringify(state)); }); } }Technical Analysis
Playwright storage state can contain authenticated LinkedIn cookies and other reusable browser authentication data. The application writes this state to
~/.config/linkedin-outreach/session.jsonusingfs.writeFileSyncwithout specifying an owner-only file mode.When a new file is created, Node.js uses default permissions subject to the process umask. Depending on the host configuration, the session file may consequently be readable by other local users or processes. The containing configuration directory is also created without an explicit owner-only mode. No permission validation is performed when an existing session file is loaded.
Possession of valid session cookies may allow authentication without knowing the account password or completing multi-factor authentication.
Attack Path
- The victim runs the
linkedin logincommand and successfully authenticates to LinkedIn. - The Skill obtains the authenticated Playwright storage state.
- The storage state is written to
~/.config/linkedin-outreach/session.jsonwith permissions determined by the environment's default umask. - Another local user or compromised process reads the session file if filesystem permissions permit it.
- The attacker imports the captured cookies and browser state into a compatible browser context.
- If the session remains valid and LinkedIn does not reject it, the attacker accesses the victim's LinkedIn account as the victim.
Impact Assessment
Successful exploitation could disclose reusable LinkedIn ...[truncated 486 chars]
- The victim runs the
- Remediation
View remediation
Remediation Suggestions
- Create
~/.config/linkedin-outreachwith owner-only permissions, such as mode0700. - Write
session.jsonwith an explicit mode of0600. - Write the state to a securely created temporary file, apply restrictive permissions, and atomically rename it into place.
- Check and correct the permissions of existing session files before loading them.
- Reject session paths that are symbolic links or otherwise resolve outside the expected configuration directory.
- Add a logout or session-deletion command that securely removes stored authentication state.
- Consider using an operating-system credential store or encrypted secret-storage facility instead of a plaintext JSON file.
- Apply equivalent owner-only protections to
data.json, which contains collected profile and outreach-message data.
- Create