T09 · Insecure Skill Coding Practices
Warning
- Location
- SETUP.md:37
- Finding
- OAuth Credentials Exposed Through Shell History and Process Arguments## Vulnerability Details **File Location**: `SETUP.md`, lines 37–43 **Vulnerability Type**: OAuth credential exposure through command-line arguments **Risk Level**: Medium ### Vulnerable Code ```bash curl -X POST https://api.fitbit.com/oauth2/token \ -H "Authorization: Basic $(echo -n 'YOUR_CLIENT_ID:YOUR_CLIENT_SECRET' | base64)" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "client_id=YOUR_CLIENT_ID&grant_type=authorization_code&redirect_uri=http://localhost&code=YOUR_CODE" ``` ### Technical Analysis The documented command asks users to substitute an OAuth client secret and authorization code directly into an interactive shell command. The unexpanded credentials may remain in shell history. During execution, the expanded Basic authorization value and request body may also be exposed through process inspection, debugging, terminal logging, or command auditing. Base64 encoding does not protect the client credentials; anyone who obtains the resulting authorization value can decode it. The request is sent over HTTPS to the legitimate Fitbit token endpoint, so this is not evidence of transmission to an unauthorized host. The weakness is local secret handling rather than the network destination. ### Attack Path 1. A user replaces the placeholders with an actual client ID, client secret, and authorization code. 2. The user runs the command in an interactive shell. 3. The command containing the client secret and authorization code is recorded in shell history, terminal logs, or system auditing records. 4. Alternatively, a local process with suitable access observes the expanded command or related process metadata while it executes. 5. An attacker retrieves the OAuth material and uses it to request or maintain access to the victim's Fitbit account data. ### Impact Assessment Successful exploitation may disclose the OAuth client secret and temporary authorization code. When combined with ...[truncated 425 chars]
- Remediation
- ## Remediation Suggestions - Replace the inline `curl` example with a reviewed helper that reads credentials from protected input, an operating-system credential store, or a file restricted to the owning user. - Do not place client secrets, authorization codes, access tokens, refresh tokens, or derived Basic authorization values in command-line arguments. - Disable command echoing around secret operations and document how users can remove any previously recorded command from shell history. - If a temporary credential file is necessary, create it under `umask 077`, enforce mode `0600`, verify ownership, and securely remove it after use. - Ensure diagnostic and error output never includes request headers, request bodies, or token responses.