T09 · Insecure Skill Coding Practices
Error
- Location
scripts/starling.sh:137- Finding
API Key Exposed Through Process Command-Line Arguments
- Content
View full analysis
&1) || true ``` The same vulnerable URL construction is used by the other request functions: ```bash curl -sfS "${CURL_TIMEOUT[@]}" ${CURL_EXTRA[@]+"${CURL_EXTRA[@]}"} "$@" "${BASE_URL}${path}?key=${API_KEY}" || { ``` ```bash body=$(curl -sfS -w '\n%{http_code}' "${CURL_TIMEOUT[@]}" ${CURL_EXTRA[@]+"${CURL_EXTRA[@]}"} "$@" "${BASE_URL}${path}?key=${API_KEY}&${params}" 2>&1) || true ``` ```bash resp=$(curl -sfS -w '\n%{http_code}' "${CURL_TIMEOUT[@]}" ${CURL_EXTRA[@]+"${CURL_EXTRA[@]}"} -X POST \ -H "Content-Type: application/json" \ -d "$body" \ "${BASE_URL}${path}?key=${API_KEY}" 2>&1) || true ``` ### Technical Analysis The Starling API requires authentication through a `key` query parameter. Although the script initially obtains the key from `STARLING_API_KEY`, it interpolates the secret directly into curl's URL argument. Consequently, the complete URL, including `?key=`, can appear in the curl process command line while a request is active. Users or monitoring services with permission to inspect that process can recover the credential. This conflicts with the script's warning that only use of the `--key` option creates process-list exposure. The network transmission itself is necessary for the declared functionality, and the query parameter is imposed by the underlying API. However, placing the resulting URL directly in an argv element is not the minimum-exposure way to perform that transmission. ### Attack Path 1. A victim configures a Starling API key through `STARLING_API_KEY`. 2. An attacker with local process-inspection access continuously monitors command lines, ...[truncated 1002 chars]- Remediation
View remediation