T09 · Insecure Skill Coding Practices
Warning
- Location
forge_client.py:101- Finding
Forge password exposed through command-line arguments
- Content
View full analysis
') email, password = args[0], args[1] data = api_request('auth', 'login', {'email': email, 'password': password}, require_auth=False) save_session({'user': data['user'], 'token': data['token']}) ``` The documented command reinforces this behavior: ```text forge_client.py login ``` ### Technical Analysis The login password is accepted as a positional command-line argument. Although transmitting the credentials to the declared Forge HTTPS authentication endpoint is necessary for login, putting the password in the process argument vector is not necessary. Depending on the operating system and local configuration, command-line arguments may be visible through process-monitoring interfaces or utilities while the command is running. The command may also be retained in interactive shell history, terminal logs, audit logs, automation logs, or diagnostic output. This behavior exceeds the minimum privilege and data-exposure requirements of the authentication feature because the password can be collected interactively without placing it in the argument vector. ### Attack Path 1. A user follows the documented command and runs `forge_client.py login user@example.com plaintext-password`. 2. The plaintext password is placed in the process argument vector and may also be recorded in shell history. 3. A local user or monitoring process with permission to inspect command lines reads the argument while the login process is active, or an attacker later obtains the user's history or automation logs. 4. The attacker uses the recovered credentials ...[truncated 555 chars]- Remediation
View remediation
') email = args[0] password = getpass.getpass('Forge password: ') data = api_request( 'auth', 'login', {'email': email, 'password': password}, require_auth=False, ) save_session({'user': data['user'], 'token': data['token']}) ``` ]]>