T09 · Insecure Skill Coding Practices
Warning
- Location
- x_tweet_monitor.py:15
- Finding
- Twitter Session Credentials Exposed Through Process Arguments## Vulnerability Details **File Location**: `x_tweet_monitor.py`, line 15 **Vulnerability Type**: Sensitive credentials exposed in subprocess arguments **Risk Level**: Medium ### Vulnerable Code ```python r = subprocess.run(["xreach","tweets",f"@{U}","-n","10","--auth-token",A,"--ct0",C,"--json"],capture_output=True,text=True,timeout=30) ``` ### Technical Analysis The code passes the sensitive `AUTH_TOKEN` and `CT0` Twitter session-cookie values directly in the `xreach` process argument vector. While the child process is running, operating-system interfaces and process-monitoring tools may expose its command line. For example, depending on the host's process-inspection permissions, the arguments may be accessible through `/proc/<pid>/cmdline`, `ps`, or equivalent monitoring facilities. The code avoids shell interpretation by supplying an argument list, so this is not a shell-command injection vulnerability. The issue is specifically the disclosure of authentication secrets through an observable process argument vector. ### Attack Path 1. The victim configures valid `AUTH_TOKEN` and `CT0` values and starts the monitor. 2. During each polling cycle, the application launches `xreach` with both secrets in its process arguments. 3. A local user or compromised process with sufficient process-inspection access reads the `xreach` command line while it is running. 4. The attacker extracts the session-cookie values. 5. The attacker reuses the credentials to make authenticated requests to X within the permissions and lifetime of the captured session. Exploitation requires local access or another foothold capable of observing the child process's arguments. ### Impact Assessment Successful exploitation can disclose the configured X session credentials. An attacker may impersonate the authenticated session and access account data or perform actions allowed by those credentials. The precise scope depends on X's session cont ...[truncated 183 chars]
- Remediation
- ## Remediation Suggestions - Do not pass authentication secrets through command-line arguments. - If supported by `xreach`, provide credentials through standard input, inherited environment variables, or a permission-restricted credential file. - If a credential file is required, create it with owner-only permissions, avoid predictable shared temporary paths, and remove it promptly after use. - Restrict process-inspection capabilities on the host using appropriate operating-system controls. - Run the monitor under a dedicated, least-privileged service account. - Rotate the Twitter session credentials after any suspected exposure and revoke obsolete sessions. - Document and pin a trusted source and version of the external `xreach` dependency.