T06 · System Persistence
Warning
- Location
scripts/setup-cron.sh:27- Finding
Persistent Token Refresh Task Installed Without Automated Removal
- Content
View full analysis
/dev/null | grep -q "pipedream-token-refresh"; then echo "ℹ️ Cron job already exists" crontab -l | grep "pipedream-token-refresh" else # Add cron job (runs every 45 minutes) CRON_LINE="*/45 * * * * /usr/bin/python3 $REFRESH_SCRIPT --quiet >> $LOG_DIR/pipedream-cron.log 2>&1" (crontab -l 2>/dev/null || echo "") | { cat; echo "$CRON_LINE"; } | crontab - echo "✅ Added cron job: runs every 45 minutes" fi ``` ### Technical Analysis The setup script modifies the user's crontab and installs a task that runs every 45 minutes across login sessions and system restarts. The task executes a credential-processing script that reads Pipedream client credentials, requests access tokens, and rewrites MCP configuration. Periodic refresh is related to the integration's functionality and is documented as optional in `INSTALL.md`. However, the persistence remains until manually removed, and the package provides neither an uninstall operation nor a command that safely identifies and removes the exact installed entry. The script is copied into a user-writable location. If that file is later replaced or modified, cron will repeatedly execute the replacement under the installing user's account. ### Attack Path 1. The user runs `scripts/setup-cron.sh`. 2. The script copies the Python refresh program to `$HOME/clawd/scripts/pipedream-token-refresh.py`. 3. A persistent cron entry is added to the user's crontab. 4. An attacker who subsequently gains write access to the installed script or its parent directory replaces the script. 5. Cron executes the modified script every 45 minutes with the user's privileges. 6. The malicious replacement can access files and credentials available to that user. ### Impact Asses ...[truncated 455 chars]- Remediation
View remediation