T09 · Insecure Skill Coding Practices
- Location
scripts/console_automator.py:20- Finding
Persisted Cloud Console Session Is Not Explicitly Protected
- Content
View full analysis
Vulnerability Details
File Location:
scripts/console_automator.py:20, 65-81
Vulnerability Type: Plaintext persistence of sensitive browser authentication state
Risk Level: MediumVulnerable Code
python STATE_FILE = os.path.expanduser("~/.qoderwork/contentsec_console_state.json") self._run_sync("state", "save", self.STATE_FILE) if not os.path.exists(self.STATE_FILE): return False self._run_sync("close") time.sleep(1) self._run_sync("state", "load", self.STATE_FILE)Technical Analysis
The console automation saves authenticated Alibaba Cloud browser state to a predictable, cross-session file and later reloads it without validating its permissions, ownership, age, or integrity.
Browser state files can contain reusable cookies or equivalent authentication artifacts. The code does not:
- Create the state file with an explicitly restrictive mode such as
0600. - Ensure the parent directory is accessible only by the current user.
- Verify file ownership or reject symbolic links before loading the file.
- Expire or automatically remove stale sessions.
- Require explicit opt-in before persisting the authenticated state.
- Provide a logout or secure cleanup operation.
Persisting authentication is convenient but exceeds the minimum privileges needed for a one-time console configuration operation. This is not a startup-service or scheduled-task persistence mechanism, but it creates sensitive state that survives the Skill run.
Attack Path
- A user runs the console configuration workflow.
- The user authenticates to Alibaba Cloud through the browser.
- The Skill saves the authenticated browser state to
~/.qoderwork/contentsec_console_state.json. - A local process or another user with read access obtains the state file.
- The attacker loads the state into a compatible browser session.
- If the cloud session remains valid, the attacker accesses the Alibaba Cloud console with the victim's effective RAM permissions.
A ...[truncated 738 chars]
- Create the state file with an explicitly restrictive mode such as
- Remediation
View remediation
Remediation Suggestions
- Disable session persistence by default and require an explicit option such as
--save-session. - Create
~/.qoderworkwith mode0700. - Create the state file atomically with mode
0600, and reject symbolic links. - Before loading, verify that the file is a regular file owned by the current user and is not group- or world-readable.
- Record an expiration time and refuse to load stale state.
- Add a logout or cleanup command that closes the browser session and securely removes the saved state.
- Prefer short-lived sessions and narrowly scoped RAM identities.
- Warn users that the file contains sensitive authentication state and must not be copied, committed, or shared.
- Disable session persistence by default and require an explicit option such as