T09 · Insecure Skill Coding Practices
Warning
- Location
- auth-utils.sh:117
- Finding
- Wallet Private Key Exposed Through Process Arguments## Vulnerability Details **File Location**: `auth-utils.sh`, line 117 **Vulnerability Type**: Sensitive credential exposure through command-line arguments **Risk Level**: Medium **Vulnerable Code**: ```bash AUTH_SIGNATURE="$(cast wallet sign --private-key "$private_key" "$message" | tr -d '\r\n')" ``` ### Technical Analysis The signing helper passes the raw wallet private key to `cast` through the `--private-key` command-line option. Although the key is used locally and is not included in gateway requests, it becomes part of the spawned process's argument vector. Depending on operating-system controls and deployment configuration, process arguments may be visible to other local users, privileged processes, monitoring agents, audit systems, debugging tools, or process snapshots. The public `--private-key` option exposed by the management scripts can additionally place the key in the invoking shell's history and the parent script's process arguments. The functionality requires signing authority, but exposing the raw key through process arguments is not the minimum-risk way to provide that authority. ### Attack Path 1. A victim invokes a management operation such as registration, update, listing, or deletion. 2. The script obtains the private key from `--private-key`, `APIOSK_PRIVATE_KEY`, or `~/.apiosk/wallet.json`. 3. `sign_wallet_auth` starts `cast wallet sign` and includes the raw key in the child process's argument vector. 4. A local attacker or monitoring component with sufficient process-observation access captures the command-line arguments while signing occurs. 5. The observer extracts the private key and uses it independently to impersonate the wallet or authorize other wallet operations. Exploitation requires local process-inspection, logging, debugging, or equivalent visibility; the audited code does not transmit the private key to `gateway.apiosk.com`. ### Impact Assessment Disclosure compromises the w ...[truncated 387 chars]
- Remediation
- ## Remediation Suggestions - Do not provide raw private keys through command-line arguments. - Prefer an encrypted keystore, hardware wallet, operating-system credential service, isolated signing agent, or secure IPC-based signer. - Use a protected standard-input or file-descriptor mechanism if supported by the signing tool, ensuring the secret never enters the process argument vector. - Remove or strongly discourage the management scripts' `--private-key` option because it can also expose credentials through shell history and the parent process command line. - Validate and document restrictive permissions for `~/.apiosk/wallet.json`, such as owner-only access. - Keep secret variables scoped as narrowly as possible and unset them immediately after signing. - Review operational logging and monitoring configurations to ensure they do not capture secret-bearing environment variables or historical command lines.