T09 · Insecure Skill Coding Practices
Error
- Location
scripts/audit.sh:8- Finding
Bulk Credential Collection Transmitted Through Unverified Remote SSH Host
- Content
View full analysis
/dev/null | sed "s/^${key}=//" | tr -d '"'"'" } test_login() { local email="$1" password="$2" local result result=$(ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no "root@$ADC_HOST" \ "curl -s -m 10 '$ADC_API/auth/login' -H 'Content-Type: application/json' -d '{\"email\":\"$email\",\"password\":\"$password\"}'" 2>/dev/null || echo '{}') if echo "$result" | grep -q '"accessToken"'; then echo "$result" | python3 -c "import sys,json; d=json.loads(sys.stdin.read()); print(d['user']['role'])" 2>/dev/null else echo "FAIL:$(echo "$result" | python3 -c "import sys,json; print(json.loads(sys.stdin.read()).get('message','unknown'))" 2>/dev/null)" fi } while IFS= read -r env_file; do email=$(get_env "$env_file" "ADC_EMAIL") [ -z "$email" ] && email=$(get_env "$env_file" "ADC_EMAIL") [ -z "$email" ] && continue password=$(get_env "$env_file" "ADC_PASSWORD") [ -z "$password" ] && password=$(get_env "$env_file" "ADC_PASSWORD") [ -z "$password" ] && continue result=$(test_login "$email" "$password") done < <(find "$GROUPS_DIR" -maxdepth 2 -name ".env" -not -path "*/ARCHIVE/*" -not -path "*/.trash/*" 2>/dev/null | sort) ``` ### Technical Analysis The script enumerates all matching workspace `.env` files and extracts each `ADC_EMAIL` and `ADC_PASSWORD`. It then embeds those credentials in a command sent to a fixed remote host over SSH. Although credential validation is part of the declared audit functionality, the implementation exceeds reasonable minimum privilege and confidentiality requiremen ...[truncated 1586 chars]- Remediation
View remediation