T09 · Insecure Skill Coding Practices
Warning
- Location
references/pagination-best-practice.md:169- Finding
Database Credentials May Be Exposed and Transmitted Without Enforced TLS
- Content
View full analysis
:3306/" + "?netTimeoutForStreamingResults=0&socketTimeout=600000"; String user = ""; String password = ""; boolean first = true; Object lastGmtCreate = null; long lastId = -1; int totalRows = 0; while (true) { try (Connection conn = DriverManager.getConnection(url, user, password)) { ``` Related MySQL command: ```bash mysql -h -P -u -p -D ``` ### Technical Analysis The JDBC example establishes a network connection using a username and password but does not require certificate-validated TLS. Depending on the JDBC driver configuration and server capabilities, credentials and database traffic may not receive adequate protection against interception or server impersonation. The password is also represented directly in application code. Users who copy the example may hardcode a real password in source files, configuration repositories, compiled artifacts, logs, or debugging output. The related MySQL CLI example places the password directly in a command-line argument. Real passwords supplied this way may be retained in shell history and can potentially be observed through local process inspection. The database connection itself is necessary for the Skill's declared functionality and points to a user-selected database. There is no indication that credentials are sent to an attacker-controlled endpoint. The issue is the absence of secure credential-handling and transport requirements. ### Attack Path 1. A user replaces the placeholders with real database connection information. 2. The password is embedded in Java source or passed as part of the MySQL command l ...[truncated 810 chars]- Remediation
View remediation
-P -u -p -D ``` 5. For automated clients, use a protected option file or credential helper and restrict its permissions. 6. Ensure database accounts follow least privilege and rotate credentials if exposure is suspected. 7. Add an explicit warning not to commit passwords, JDBC URLs containing secrets, or database option files to source control. ]]>