T09 · Insecure Skill Coding Practices
Warning
- Location
bin/cli.js:33- Finding
Marketplace API Keys Exposed Through Command-Line Arguments
- Content
View full analysis
', 'API 密钥') .option('-p, --platform ', '目标平台 (tiktok|amazon|shopee|lazada|all)') .option('-o, --output ', '输出格式 (json|table|csv)', 'table') .option('--feishu', '启用飞书多维表格同步') .option('--debug', '调试模式'); ``` ```js // commands/platform.js:70-77 const config = { name: platform, apiKey: options.apiKey || '', connected: false, createdAt: new Date().toISOString() }; await platformManager.addPlatform(config); ``` ### Technical Analysis The CLI accepts a marketplace API key directly through the `--api-key` command-line argument. Secrets supplied in this manner may be exposed through: - Shell history files. - Process inspection tools such as `ps`. - Process accounting and monitoring systems. - Terminal session logging. - CI/CD logs or command tracing. - Diagnostic or support bundles. The command handler then copies the argument into the persistent platform configuration. Although the application masks API keys when listing configured platforms, that masking does not protect the original command line or shell history. ### Attack Path 1. A user executes a command such as: ```bash crossborder-ecom --api-key REAL_SECRET platform --add tiktok ``` 2. The full command may be written to the user's shell history. 3. While the process is running, another local process or account with sufficient process-inspection access reads the command arguments. 4. Alternatively, a monitoring, logging, or CI system records the command. 5. The attacker recovers the API key and authenticates to the corresponding marketplace API. ### Impact Assessment Successful exploitation discloses the supplied marketplace API key. The attacker's effectiv ...[truncated 359 chars]- Remediation
View remediation