T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sn.sh:19- Finding
Basic Authentication Credentials Can Be Exposed Through Plaintext HTTP and Process Arguments
- Content
View full analysis
&2; exit 1; } info() { echo "→ $*" >&2; } sn_curl() { local method="$1" url="$2" shift 2 curl -sf -X "$method" "$url" \ -u "$AUTH" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ "$@" } ``` ### Technical Analysis The instance URL validation does not enforce HTTPS. It only tests whether `SN_INSTANCE` starts with the characters `http`, so an explicitly configured `http://` URL passes the check unchanged. Basic Authentication credentials are therefore eligible to be transmitted over an unencrypted connection. The code also combines the username and reusable password into `AUTH` and supplies that value through the `curl` command-line option `-u "$AUTH"`. On systems where process command lines are visible to other users, monitoring tools, diagnostic utilities, or privileged processes, the resulting `username:password` argument may be observed while `curl` is running. The same command-line authentication pattern is also used directly by delete, attachment, and batch-delete requests elsewhere in the script. The issue is especially significant because the account can be authorized for CRUD operations across sensitive ServiceNow tables. No hardcoded credentials, hidden credential destination, or deliberate credential collection was identified. Exploitation requires influence over configuration or network traffic, or local process-inspection access. ### Attack Path #### Plaintext transport path 1. A user or automation system co ...[truncated 1934 chars]- Remediation
View remediation