T09 · Insecure Skill Coding Practices
Error
- Location
scripts/login.py:43- Finding
Telegram Authentication Secrets Exposed Through Command-Line Arguments
- Content
View full analysis
= 5 and sys.argv[1] == "verify": phone = sys.argv[2] code = sys.argv[3] phone_code_hash = sys.argv[4] password = sys.argv[5] if len(sys.argv) > 5 else None ``` The corresponding documented commands are: ```bash python3 scripts/login.py verify +1234567890# If 2FA is enabled, append your password: python3 scripts/login.py verify +1234567890<2FA_PASSWORD> ``` ### Technical Analysis The verification code, phone-code hash, telephone number, and optional Telegram 2FA password are accepted as command-line arguments. Command-line secrets may be exposed through: - Shell history files. - Process inspection utilities while the command is running. - Endpoint monitoring and process-accounting systems. - Terminal session capture and command logging. - Diagnostic reports or automation logs that record executed commands. The script also prints a partially constructed verification command containing the user's telephone number and phone-code hash: ```python print(f"Run: python3 login.py verify {phone}{result.phone_code_hash}") ``` Although sending authentication data to Telegram is necessary for login, transporting these secrets through command-line arguments is not necessary and exceeds minimum-risk credential handling. ### Attack Path 1. A user follows the documented login procedure and supplies the Telegram verification code and optional 2FA password on the command line. 2. The shell records the command in its history, or a local monitoring system captures the process arguments. 3. An attacker with access to the user's shell history, process telemetry, terminal logs, or local process information obtains the te ...[truncated 946 chars]- Remediation
View remediation