T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/dolphin_setup.js:100
- Finding
- API Token Stored in an Unprotected Plaintext File<![CDATA[ ## Vulnerability Details **File Location**: `scripts/dolphin_setup.js:18, 100-101` **Vulnerability Type**: Plaintext credential storage **Risk Level**: Medium ### Vulnerable Code ```javascript const TOKEN_FILE = path.join(__dirname, '..', '.token'); ``` ```javascript // 2. Save token to file fs.writeFileSync(TOKEN_FILE, token, 'utf8'); console.log(`💾 Токен сохранён: ${TOKEN_FILE}`); ``` ### Technical Analysis The setup script writes a reusable Dolphin Anty API bearer token directly into `.token` inside the project directory. The file permissions are determined by the process umask; the script does not explicitly restrict the file to its owner, validate existing file ownership, use an operating-system credential store, or encrypt the credential. Storing the token within the project also increases the probability that it will be included accidentally in source-control commits, backups, archives, or project-directory transfers. In addition, the documented `--token` argument exposes the secret to shell history and may temporarily expose it through process-list inspection. The token is subsequently used to authenticate to the Dolphin Anty cloud API, including profile listing, creation, and deletion operations. ### Attack Path 1. A user runs `dolphin_setup.js --token <API_TOKEN>`. 2. The script writes the token to the project-root `.token` file. 3. A local user or process with read access to the project directory reads the file. Alternatively, the file is accidentally included in a repository, archive, or backup. 4. The attacker extracts the bearer token. 5. The attacker submits the token to `https://dolphin-anty-api.com`. 6. The attacker accesses or modifies the victim's Dolphin Anty browser profiles according to the token's account permissions. ### Impact Assessment Successful exploitation discloses a reusable cloud API credential. The attacker may obtain the same Dolphin Anty API privileges as the token holder, potentially including: - Enum ...[truncated 470 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Store the token in an operating-system credential manager, such as macOS Keychain, Windows Credential Manager, or Linux Secret Service. 2. If file-based storage is unavoidable: - Store the file outside the project directory. - Create it with owner-only permissions such as mode `0600`. - Verify that the file is owned by the current user and is not a symbolic link before writing. - Refuse to use files with unsafe permissions. 3. Add `.token` to the project's `.gitignore` and relevant packaging exclusion files. 4. Accept the token through standard input or an interactive hidden prompt rather than a command-line argument. 5. Avoid printing the credential file's exact location unless required for troubleshooting. 6. Use short-lived, minimally scoped API tokens and document immediate revocation procedures. 7. Rotate any token that may already have been stored with excessive permissions or included in a shared artifact. ]]>