T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fnclub_signer.js:86- Finding
Authentication cookies and OAuth access tokens are stored in plaintext without enforced restrictive permissions
- Content
View full analysis
({ name: c.key, value: c.value, domain: c.domain, path: c.path })); fs.writeFileSync(this.config.cookieFile, JSON.stringify(cookieList, null, 2)); ``` The Baidu OAuth access token is also serialized directly to a plaintext file: ```js const { access_token, expires_in = 2592000 } = response.data; fs.writeFileSync(this.config.tokenCacheFile, JSON.stringify({ access_token, expires_time: Date.now() + (expires_in - 86400) * 1000 })); ``` ### Technical Analysis The application persists reusable forum session cookies and a Baidu OAuth access token using `fs.writeFileSync` without specifying a restrictive file mode. The effective permissions therefore depend on the process umask and the permissions of the selected data directory. By default, these files are stored under the script directory. However, the `FNCLUB_DATA_DIR` environment variable can redirect them to another directory. If that directory is shared, incorrectly permissioned, backed up insecurely, or accessible to another local account or process, the cached credentials may be disclosed. The stored forum cookies can represent an authenticated session and may allow account access without knowledge of the forum password. The Baidu access token can authorize OCR API requests until it expires or is revoked. ### Attack Path 1. The Skill runs and successfully authenticates to the forum or obtains a Baidu OAuth token. 2. It writes the credentials to `cookies.json` or `token_cache.json`. 3. The files receive permissions derived from the runtime umask rather than an explicitly enforced owner-only mode. 4. A local attacker, co-tenant process, or ser ...[truncated 1209 chars]- Remediation
View remediation