T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/iex_cloud_cli.sh:224
- Finding
- IEX API Token Exposed Through Process Command-Line Arguments## Vulnerability Details **File Location**: `scripts/iex_cloud_cli.sh:108-111`, `scripts/iex_cloud_cli.sh:224-231` **Vulnerability Type**: API credential disclosure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash --token) [[ $# -ge 2 ]] || die "--token requires a value" TOKEN="$2" shift 2 ;; ``` ```bash curl_args=( --silent --show-error --fail-with-body --max-time "$TIMEOUT" --get "$URL" --data-urlencode "token=$TOKEN" ) ``` ### Technical Analysis The CLI accepts an API token through the `--token TOKEN` command-line option. This exposes the token in the CLI process's command line and may also preserve it in shell history. Regardless of whether the token originates from the command line or an environment variable, the script then embeds it in a `curl` argument: ```bash --data-urlencode "token=$TOKEN" ``` Consequently, the spawned `curl` process contains the plaintext credential in its argument vector. Depending on operating-system process visibility and monitoring configuration, the argument may be observable through process inspection interfaces or process-monitoring tools. Although IEX Cloud requires query-parameter authentication, the token does not need to be passed from the script to `curl` as a visible command-line argument. This issue is limited to local credential exposure; the audited code restricts the network destination to the declared IEX API hosts. ### Attack Path 1. A user executes the CLI with a valid IEX token, either through `--token TOKEN` or a supported environment variable. 2. If `--token` is used, the plaintext token appears in the original CLI command line and may be recorded in shell history. 3. The script constructs the `curl_args` array with `token=$TOKEN`. 4. The script launches `curl`, placing the plaintext token in the child process's argument vector. 5. A local user, privileged monitoring service, diagnostic collector, or other process with permission to inspect process ...[truncated 848 chars]
- Remediation
- ## Remediation Suggestions 1. Remove or deprecate the `--token TOKEN` option because it directly exposes credentials in command history and the CLI process command line. 2. Obtain tokens from an approved secret-management mechanism or a protected input channel. For interactive use, support silent input with `read -r -s`. 3. Avoid placing the token in the spawned `curl` argument vector. Supply sensitive curl configuration through protected standard input or a securely managed file descriptor, such as invoking `curl --config -` and sending the sensitive option through standard input. 4. If a temporary configuration file is unavoidable, create it with permissions restricted to the current user, prevent symbolic-link attacks, and delete it reliably with a shell `trap`. 5. Ensure tokens remain excluded from warnings, error messages, debugging traces, telemetry, and request logs. 6. Document that environment-variable injection through the platform's SecretRef mechanism is preferred, while noting that environment visibility should also be restricted through appropriate operating-system process controls. 7. Add an automated regression test that inspects the spawned `curl` command line and fails if the token appears in its argument vector.