T09 · Insecure Skill Coding Practices
Warning
- Location
- src/config.py:22
- Finding
- Camera credential file is created without enforced restrictive permissions<![CDATA[ ## Vulnerability Details **File Location**: `src/config.py:22-27` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```python def _ensure_file(): """首次运行时将捆绑模板复制到用户配置路径。""" if not DEVICE_FILE.exists(): DEVICE_FILE.parent.mkdir(parents=True, exist_ok=True) if BUNDLED_TEMPLATE.exists(): shutil.copy(BUNDLED_TEMPLATE, DEVICE_FILE) ``` ### Technical Analysis The copied `camera-devices.json` file is explicitly intended to contain camera usernames and passwords. However, `_ensure_file()` does not set restrictive permissions on either the workspace directory or the resulting credential file. `Path.mkdir()` and `shutil.copy()` rely on the process umask and source-file permissions. A commonly packaged template may be readable by all local users, and `shutil.copy()` preserves its permission mode. The documentation advises users to protect the file, but documentation alone does not enforce the confidentiality of the credentials. Exploitation requires local filesystem access and depends on the effective permissions and operating-system access controls. This is not a remote credential theft vulnerability by itself. ### Attack Path 1. SmartEye runs for the first time and copies the bundled template to `~/.openclaw/workspace/camera-devices.json`. 2. The user replaces the placeholder values with real camera credentials. 3. The copied file retains permissive permissions, or the process umask allows local users to read it. 4. Another local account or compromised process reads the configuration file. 5. The attacker reuses the exposed credentials to connect to the RTSP service or other camera management interfaces. ### Impact Assessment A successful attacker may obtain: - Camera usernames and passwords. - Access to private live video streams and snapshots. - PTZ control privileges available to the compromised camera account. - Access to other camera interfaces if the sa ...[truncated 228 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Create the workspace directory with owner-only permissions: ```python DEVICE_FILE.parent.mkdir(parents=True, exist_ok=True, mode=0o700) DEVICE_FILE.parent.chmod(0o700) ``` 2. After copying the configuration, explicitly set mode `0600` on POSIX systems: ```python shutil.copyfile(BUNDLED_TEMPLATE, DEVICE_FILE) DEVICE_FILE.chmod(0o600) ``` 3. Before loading the file, inspect its permissions and warn or refuse to load real credentials when group or world access is enabled. 4. Use operating-system-specific access-control APIs on Windows rather than relying exclusively on POSIX mode bits. 5. Prefer a system keyring or secret manager for passwords. Keep only non-sensitive device metadata in the JSON file. 6. Recommend dedicated, least-privileged camera accounts instead of administrator accounts, and discourage credential reuse. ]]>