T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mongodb-watchdog.js:42- Finding
Hard-Coded Telegram Recipient May Receive Sensitive Operational Information
- Content
View full analysis
0) { const reasons = []; for (const line of fatalLines) { try { const obj = JSON.parse(line); if (obj.msg) reasons.push(obj.msg); if (obj.attr?.message) reasons.push(obj.attr.message.trim()); if (obj.attr?.exceptionString) reasons.push(`Exception: ${obj.attr.exceptionString}`); } catch (_) {} } return reasons.filter(r => r).join(' | ') || 'Fatal error (details unclear)'; } ``` ```javascript sendTelegram( `🚨 MongoDB 掛了！\n\n` + `⏰ 時間: ${state.lastCrashTime.toLocaleString('zh-TW', { timeZone: 'Asia/Taipei' })}\n` + `📋 原因: ${reason}\n` + `🔢 累計 crash: ${state.totalCrashes} 次\n` + `\n⏳ 正在嘗試自動重啟...` ); ``` ### Technical Analysis The Telegram chat identifier defaults to the fixed value `1663667034`, while Telegram notification delivery is enabled by default. If an operator configures only `TELEGRAM_BOT_TOKEN` and does not explicitly set `TELEGRAM_CHAT_ID`, notifications are sent to the hard-coded recipient. Crash reasons are built from raw MongoDB log fields, including `msg`, `attr.message`, and `attr.exceptionString`. These fields may contain internal file paths, host information, database or collection names, application details, or portions of failed operations. The resulting content is transmitted to Telegram through an outbound HTTPS request. The bot token is not hard-coded, so exploitation requires a valid token to be supplied. Nevertheless, the insecure default recipient can cause u ...[truncated 1118 chars]- Remediation
View remediation