T09 · Insecure Skill Coding Practices
Warning
- Location
bitbucket-cli.sh:22- Finding
Bitbucket API Token Exposed Through Process Arguments
- Content
View full analysis
&2 echo "$err" exit 1 fi echo "$body" } bb_get_raw() { local http_code body body=$(curl -s -w "\n%{http_code}" -u "$AUTH" "$1") ``` ### Technical Analysis The script concatenates the Atlassian email address and Bitbucket API token into `AUTH`, then supplies the resulting credential to `curl` using the `-u` command-line option. Consequently, the credential may appear in the process argument vector while `curl` is running. On systems where process arguments are visible to other users, privileged monitoring agents, diagnostic tooling, or command telemetry, an observer may recover the complete Basic Authentication credential. Shell quoting prevents argument splitting but does not prevent exposure through process inspection. The documented recommendation to use a read-only token limits the possible damage, but it does not eliminate credential disclosure. The actual scope depends on the permissions assigned to the exposed token. ### Attack Path 1. An attacker obtains local process-inspection capability or access to telemetry that records process command lines. 2. A user invokes any CLI operation that calls `bb_get` or `bb_get_raw`. 3. The script launches `curl` with `-u "$ATLASSIAN_EMAIL:$BITBUCKET_API_TOKEN"`. 4. The attacker observes the `curl` pr ...[truncated 781 chars]- Remediation
View remediation