T09 · Insecure Skill Coding Practices
- Location
scripts/address_book/base.py:232- Finding
Unredacted Firewall Configuration Logged During Address-Book Restore
- Content
View full analysis
Vulnerability Details
File Location:
scripts/address_book/base.py:232-237
Vulnerability Type: Sensitive information exposure through verbose logging
Risk Level: Mediumpython print(f" [{self.name}] [{idx+1}] restoring: {record_name}") print(f" API params: {api_params}") try: result = call_api_fn(ak, sk, endpoint, self.restore_api, api_params, security_token) print(f" API response: {result}")Technical Analysis
The generic address-book restoration routine prints the complete API parameter dictionary and API response without redaction. Depending on the selected plugin, these objects can contain:
- Private IP addresses and network ranges
- Internal DNS server addresses and domain names
- VPC, vSwitch, endpoint, connector, and address-book identifiers
- Account-related identifiers
- Firewall boundary assignments and internal topology details
The AccessKey secret and security token are passed separately to
call_api_fnand are not directly included inapi_params. Therefore, the reviewed code does not directly print authentication credentials. Nevertheless, the logged configuration is sensitive operational information.Because standard output is commonly retained by CI systems, agent transcripts, shell capture tools, or centralized logging services, this behavior can disclose more information than is required to report restore progress.
Attack Path
- An operator runs an address-book, ACK connector, or private DNS restore.
- The Skill constructs an API request containing internal infrastructure configuration.
- The complete
api_paramsobject and API response are written to standard output. - A CI logger, terminal recorder, agent platform, or log aggregation service retains that output.
- An attacker or unauthorized user with access to those logs extracts internal IP ranges, DNS details, resource identifiers, and firewall topology information.
- The disclosed information can support infrastructure mappi ...[truncated 549 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove logging of complete request and response objects from normal operation.
- Log only the minimum information needed to track progress, such as:
- Plugin name
- Record index
- Sanitized record name
- API action
- Success or failure status
- Error code and request ID
- Implement an allowlist-based sanitization function rather than attempting to block only known sensitive keys.
- Redact private IP addresses, CIDR ranges, DNS names, account IDs, VPC and vSwitch IDs, endpoint identifiers, security tokens, signatures, and AccessKey identifiers.
- Place detailed diagnostics behind an explicit debug option that is disabled by default.
- Display a warning before debug logging and ensure debug output still redacts credentials and tokens.
- Review all other restore implementations for equivalent verbose output and apply a shared sanitized logging utility consistently.
A safer pattern would be:
python print(f" [{self.name}] [{idx + 1}] restoring: {record_name}") result = call_api_fn( ak, sk, endpoint, self.restore_api, api_params, security_token ) print( f" API result: code={result.get('Code', 'OK')}, " f"request_id={result.get('RequestId', '')}" )