T09 · Insecure Skill Coding Practices
Warning
- Location
- references/client-templates.md:42
- Finding
- Temporary Password Disclosed in Client Email Template## Vulnerability Details **File Location**: `references/client-templates.md`, lines 42–45 **Vulnerability Type**: Plaintext credential disclosure through email **Risk Level**: Medium ```text **What you need to do:** 1. Go to https://mail.google.com and sign in with your work email 2. Your password is: [temporary password / SSO instructions] 3. Check that your emails and calendar look correct ``` ### Technical Analysis The user-announcement template instructs migration operators to place a temporary account password directly in an email message. Email is not an appropriate secret-delivery channel because messages may be retained indefinitely, forwarded, synchronized to unmanaged devices, included in backups, exposed through mail logs, or accessed through the source mailbox during and after migration. Although the value shown is a placeholder rather than a hardcoded credential, the template encourages an insecure operational practice when populated with a real password. ### Attack Path 1. A migration operator replaces the placeholder with a user's active temporary password. 2. The operator sends the migration announcement by email. 3. A threat actor obtains the message through a compromised mailbox, forwarding rule, shared mailbox, archived copy, backup, mail log, or unmanaged synchronized device. 4. The actor extracts the temporary password. 5. Before the password expires or is changed, the actor authenticates to the user's Google Workspace account. 6. If MFA is absent or bypassable, the actor accesses migrated email and any additional Workspace resources available to that account. ### Impact Assessment Successful exploitation could provide the privileges of the affected Google Workspace user. The accessible scope may include migrated email, contacts, calendars, and other Workspace services authorized for that account. Impact could increase if the affected user has administrative privileges, if MFA is not enforced, or if the password is reused elsewhere. ...[truncated 176 chars]
- Remediation
- ## Remediation Suggestions - Remove the password field from the email template. - Send only SSO instructions or an approved account-activation workflow in the announcement. - Deliver credentials through a secure, identity-verified channel, such as a short-lived single-use activation or password-reset link. - Ensure activation links expire quickly, cannot be reused, and are invalidated after successful use. - Require users to establish a new password during first login rather than sending an operator-selected password. - Enforce MFA for all users and phishing-resistant MFA for privileged accounts. - Avoid sending activation material to the mailbox whose security depends on the disclosed credential. - Document procedures for identity verification, credential expiration, delivery failure, and suspected disclosure. - Review sent announcements, mail archives, and templates to ensure no live credentials remain after migration.