T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cookie_alive.py:323- Finding
Session cookies are stored without restrictive filesystem permissions
- Content
View full analysis
sqlite3.Connection: db_path.parent.mkdir(parents=True, exist_ok=True) conn = sqlite3.connect(db_path) conn.row_factory = sqlite3.Row conn.executescript(SCHEMA) return conn ``` The database schema stores reusable authentication material directly in the `cookie_json` column: ```python SCHEMA = """ CREATE TABLE IF NOT EXISTS sessions ( profile TEXT PRIMARY KEY, refresh_url TEXT NOT NULL, method TEXT NOT NULL, interval_seconds INTEGER NOT NULL, timeout_seconds INTEGER NOT NULL, cookie_json TEXT NOT NULL, headers_json TEXT NOT NULL, body TEXT, active INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, last_refreshed_at TEXT, last_status_code INTEGER, last_error TEXT ); """ ``` ### Technical Analysis The application creates the cookie storage directory and SQLite database using process-default permissions. It does not explicitly set the directory to owner-only mode such as `0700` or the database to `0600`. The resulting permissions depend on the process umask and properties of any pre-existing storage directory. In an environment with permissive defaults, another local user or service account may be able to read the SQLite database. The database stores live session-cookie name/value pairs in plaintext, so possession of the file may be equivalent to possession of the associated authenticated sessions. The implementation also does not verify that the database path is not a symbolic link, that the file is owned by the current user, or that an existing file has safe permissions. ### Attack Path 1. A user creates or updates a profile containing an authenticated website session cookie. 2. `connect()` creates ...[truncated 897 chars]- Remediation
View remediation