T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/healthcheck.sh:351
- Finding
- Excessive Collection of Sensitive User and System Data## Vulnerability Details **File Location**: `scripts/healthcheck.sh:351-365`, `scripts/healthcheck.sh:437-451`, and `scripts/healthcheck.sh:560-570` **Vulnerability Type**: Sensitive information collection beyond least-privilege requirements **Risk Level**: High ### Vulnerable Code ```bash subsection "6.4 SSH Keys & Access" { echo "=== SSH Authorized Keys ===" if [ -d ~/.ssh ]; then for keyfile in ~/.ssh/authorized_keys ~/.ssh/authorized_keys2; do [ -f "$keyfile" ] && echo "$keyfile:" && cat "$keyfile" | head -5 done fi echo "" echo "=== SSH Known Hosts ===" if [ -f ~/.ssh/known_hosts ]; then head -10 ~/.ssh/known_hosts fi } >> "$REPORT_FILE" ``` ```bash subsection "8.1 Environment Variables" { echo "=== Key Environment Variables ===" echo "PATH: $PATH" | head -5 echo "" echo "=== All Environment Variables ===" env | sort | head -40 } >> "$REPORT_FILE" subsection "8.2 Shell Configuration" { echo "=== Shell History (last 20) ===" if [ -f ~/.bash_history ]; then tail -20 ~/.bash_history fi echo "" echo "=== Aliases ===" alias 2>/dev/null | head -20 } >> "$REPORT_FILE" ``` ```bash subsection "12.1 User Crontab" crontab -l 2>/dev/null >> "$REPORT_FILE" || echo "No user crontabs" >> "$REPORT_FILE" subsection "12.2 System Cron" { echo "=== /etc/crontab ===" cat /etc/crontab 2>/dev/null echo "" echo "=== Cron.d files ===" ls -la /etc/cron.d/ 2>/dev/null } >> "$REPORT_FILE" ``` ### Technical Analysis The declared purpose is PC health diagnostics. CPU, memory, storage, service status, and aggregate security indicators are reasonably related to that purpose. Copying SSH authorization records, known-host entries, arbitrary environment-variable values, command ...[truncated 2193 chars]
- Remediation
- ## Remediation Suggestions 1. Remove raw environment-variable and shell-history collection from the default health check. 2. Do not copy `authorized_keys` or `known_hosts` contents. Report only non-sensitive metadata such as: - Whether the files exist. - File ownership and permission modes. - Number of authorized entries. - Cryptographic fingerprints without comments or key material, when explicitly requested. 3. Replace complete cron output with aggregate information, such as the number of configured jobs and whether expected scheduler entries exist. 4. Put all security-sensitive inspection behind explicit, separate opt-in flags. 5. Redact values matching secret-bearing names such as `TOKEN`, `PASSWORD`, `SECRET`, `API_KEY`, and credential URL patterns. 6. Warn users before collecting data that may identify remote systems or authorization relationships. 7. Refuse privileged execution by default, or require an explicit option after clearly explaining the expanded collection scope.