T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/extract_cookies.py:121
- Finding
- Authentication Cookies Are Extracted, Printed, and Cached in Plaintext<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extract_cookies.py:25-31`, `scripts/extract_cookies.py:82-94`, and `scripts/extract_cookies.py:121-129` **Vulnerability Type**: Plaintext storage and disclosure of authentication credentials **Risk Level**: High ### Vulnerable Code ```python CACHE_DIR = "/tmp/form_api_cookies" CACHE_MAX_AGE = 3600 # 1 hour expiration def get_cache_path(domain: str) -> str: os.makedirs(CACHE_DIR, exist_ok=True) domain_hash = hashlib.md5(domain.encode()).hexdigest()[:8] safe_domain = domain.replace(".", "_").replace(":", "_") return os.path.join(CACHE_DIR, f"{safe_domain}_{domain_hash}.txt") ``` ```python ws.send(json.dumps({ "id": 1, "method": "Network.getCookies", "params": {"urls": [target_url]} })) result = json.loads(ws.recv()) ws.close() cookies = result.get("result", {}).get("cookies", []) if not cookies: print(f"WARNING: No cookies found for {target_url}", file=sys.stderr) return "" cookie_str = "; ".join([f"{c['name']}={c['value']}" for c in cookies]) return cookie_str ``` ```python if cookie_str: with open(cache_path, "w") as f: f.write(cookie_str) print(f"# Saved to: {cache_path}", file=sys.stderr) print(cookie_str) else: print("ERROR: Failed to extract cookies", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The script uses Chrome DevTools Protocol `Network.getCookies` to retrieve browser cookies for the target URL. This interface may return sensitive session cookies, including HttpOnly cookies that normal page JavaScript cannot access. The resulting cookie string is: 1. Written unencrypted to a predictable directory under `/tmp`. 2. Created without explicitly enforcing owner-only permissions such as mode `0600`. 3. Retained for up to one hour. 4. Printed directly to standard output, where it may be captured by shell history-adjacent tooling, agent transcripts, CI logs, parent processes, or generated command output. The ...[truncated 1764 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Avoid persistent cookie caching unless it is strictly necessary. - Require explicit user confirmation immediately before extracting browser cookies. - Do not print raw cookie values to standard output. Pass credentials through a protected in-memory mechanism or directly into the authorized request process. - If temporary storage is unavoidable: - Create a private per-user directory with mode `0700`. - Create files atomically and exclusively with mode `0600`. - Use `tempfile` or an equivalent secure temporary-file API. - Reject symlinks and verify file ownership before reading or writing. - Delete the credential file immediately after use rather than retaining it for one hour. - Never include live cookie values in generated API documentation, logs, transcripts, or error messages. - Prefer narrowly scoped, short-lived API tokens over full browser session cookies where the target system supports them. - Document that CDP can expose HttpOnly session credentials and ensure the debugging endpoint is accessible only to the intended local user. ]]>