T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/redis-health.sh:6- Finding
Redis Credentials Exposed Through Process Command-Line Arguments
- Content
View full analysis
``` ```bash redis-cli -h -p -a ``` ### Technical Analysis The Redis connection URL may contain a username and password, such as `redis://user:password@host:6379`. The script places this entire URL in the arguments passed to `redis-cli`. The documented alternative similarly passes a password through the `-a` command-line option. Command-line arguments may be recorded or exposed through operating-system process inspection, process-monitoring agents, debugging tools, audit logs, shell history when commands are entered manually, or diagnostic collection systems. The script's `SAFE_URL` masking protects only its displayed report; it does not mask the arguments of the running `redis-cli` process. The `CLI` variable is also a plain command string rather than a Bash array. Expanding `$CLI` causes word splitting and pathname expansion. A URL containing whitespace can therefore be split into additional `redis-cli` arguments. This makes argument handling unreliable and increases risk if the URL or script argument originates from an untrusted source. ### Attack Path 1. A Redis URL containing valid credentials is supplied as the first script argument or through the documented invocation pattern. 2. The script constructs a command such as `redis-cli -u redis://user:password@host:6379 ping`. 3. While the process is running, a local account, monitoring agent, audit facility, or process-inspection tool captures its command-line arguments. 4. The observer extracts the Redis usernam ...[truncated 1247 chars]- Remediation
View remediation