T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/address_book/base.py:232
- Finding
- Unredacted Firewall Configuration Logged During Address-Book Restore## Vulnerability Details **File Location**: `scripts/address_book/base.py:232-237` **Vulnerability Type**: Sensitive information exposure through verbose logging **Risk Level**: Medium ```python print(f" [{self.name}] [{idx+1}] restoring: {record_name}") print(f" API params: {api_params}") try: result = call_api_fn(ak, sk, endpoint, self.restore_api, api_params, security_token) print(f" API response: {result}") ``` ### Technical Analysis The generic address-book restoration routine prints the complete API parameter dictionary and API response without redaction. Depending on the selected plugin, these objects can contain: - Private IP addresses and network ranges - Internal DNS server addresses and domain names - VPC, vSwitch, endpoint, connector, and address-book identifiers - Account-related identifiers - Firewall boundary assignments and internal topology details The AccessKey secret and security token are passed separately to `call_api_fn` and are not directly included in `api_params`. Therefore, the reviewed code does not directly print authentication credentials. Nevertheless, the logged configuration is sensitive operational information. Because standard output is commonly retained by CI systems, agent transcripts, shell capture tools, or centralized logging services, this behavior can disclose more information than is required to report restore progress. ### Attack Path 1. An operator runs an address-book, ACK connector, or private DNS restore. 2. The Skill constructs an API request containing internal infrastructure configuration. 3. The complete `api_params` object and API response are written to standard output. 4. A CI logger, terminal recorder, agent platform, or log aggregation service retains that output. 5. An attacker or unauthorized user with access to those logs extracts internal IP ranges, DNS details, resource identifiers, and firewall topology information. 6. The disclosed information can support infrastructure mappi ...[truncated 549 chars]
- Remediation
- ## Remediation Suggestions 1. Remove logging of complete request and response objects from normal operation. 2. Log only the minimum information needed to track progress, such as: - Plugin name - Record index - Sanitized record name - API action - Success or failure status - Error code and request ID 3. Implement an allowlist-based sanitization function rather than attempting to block only known sensitive keys. 4. Redact private IP addresses, CIDR ranges, DNS names, account IDs, VPC and vSwitch IDs, endpoint identifiers, security tokens, signatures, and AccessKey identifiers. 5. Place detailed diagnostics behind an explicit debug option that is disabled by default. 6. Display a warning before debug logging and ensure debug output still redacts credentials and tokens. 7. Review all other restore implementations for equivalent verbose output and apply a shared sanitized logging utility consistently. A safer pattern would be: ```python print(f" [{self.name}] [{idx + 1}] restoring: {record_name}") result = call_api_fn( ak, sk, endpoint, self.restore_api, api_params, security_token ) print( f" API result: code={result.get('Code', 'OK')}, " f"request_id={result.get('RequestId', '')}" ) ```