T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/ms-todo-oauth.py:36
- Finding
- Published OAuth Client Secret Used as an Automatic Fallback<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ms-todo-oauth.py:36-38` **Vulnerability Type**: Hardcoded OAuth application credentials **Risk Level**: High ### Vulnerable Code ```python # Built-in fallback OAuth app credentials. Override with CLI options or env vars. DEFAULT_CLIENT_ID = "ca6ec244-002c-435b-bafd-06e470d37edc" DEFAULT_CLIENT_SECRET = "TwQ8Q~mHv6C_scYqI7PC2dZKWFeM931.8AczhasR" ``` ### Technical Analysis The source code contains an OAuth confidential-client secret and automatically uses it when the caller does not provide another value. Because the project distributes this source, the secret must be considered publicly compromised. Documentation acknowledging that the secret is public does not make its continued use secure. An OAuth client secret authenticates the registered application to Microsoft Entra ID. Anyone with access to this project can copy the client ID and secret and attempt to impersonate the application. Actual access to user data would still depend on successfully completing an applicable OAuth flow and on the registered application's tenant, redirect URI, and permission configuration; possession of the secret alone does not directly grant access to every user account. The embedded credential is not required for the Skill's minimum functionality. Users can register their own application, and an interactive CLI can use a public-client authorization flow with PKCE or device authorization rather than distributing a confidential-client secret. ### Attack Path 1. An attacker downloads or otherwise obtains the project. 2. The attacker extracts the embedded client ID and client secret. 3. The attacker submits the credentials to Microsoft Entra endpoints while impersonating the registered application. 4. Depending on the application's registration and redirect configuration, the attacker abuses supported OAuth flows, application quotas, or consent associated with that application. 5. If the attacker can also obtain ...[truncated 641 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Revoke the exposed client secret immediately in Microsoft Entra ID and review the application's sign-in and audit logs. 2. Remove the secret from the source tree, documentation, tests, release artifacts, and version-control history. 3. Do not provide another shared fallback secret. 4. For an installed CLI, use a public-client OAuth flow with PKCE or device authorization where supported, avoiding the need to distribute a confidential-client credential. 5. If a confidential-client flow is strictly required, require each operator to supply credentials through an approved secret manager or protected environment injection. 6. Fail closed with a clear setup error when required credentials are absent. 7. Add automated secret scanning and pre-commit checks to prevent future credential commits. ]]>