T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/miniflux-cli.py:27
- Finding
- Miniflux API key is stored in a plaintext configuration file without enforced restrictive permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/miniflux-cli.py`, lines 27-32 **Vulnerability Type**: Plaintext credential storage with insecure file permissions **Risk Level**: High ### Vulnerable Code ```python def save_config(base_url: str, api_key: str): CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True) with open(CONFIG_PATH, "w") as f: json.dump({"base_url": base_url, "api_key": api_key}, f, indent=2) ``` ### Technical Analysis The `save_config` function writes the Miniflux API key directly to `~/.local/share/miniflux/config.json`. The code does not explicitly set restrictive permissions on either the configuration directory or file. The resulting permissions depend on the process umask. Under a common `022` umask, a newly created file can be readable by other local users. The code also does not correct insecure permissions on an existing configuration file or protect against the destination being a symbolic link. Although credential storage supports the declared Miniflux functionality, storage in a broadly readable plaintext file exceeds the minimum privileges necessary. Only the account running the Skill should be able to access the credential. ### Attack Path 1. A user invokes the CLI with a Miniflux API key. 2. The CLI calls `save_config` and writes the API key to `config.json`. 3. The file is created with permissions derived from the current umask or retains insecure existing permissions. 4. Another local account, process, or compromised application reads the file. 5. The attacker uses the recovered API key to authenticate to the configured Miniflux server. A symbolic-link attack may also be possible when an attacker can manipulate the configuration path before the file is opened, potentially redirecting the credential into another file accessible to the attacker. ### Impact Assessment Successful exploitation discloses the Miniflux API key and server URL. The privileges available to an attacker depend on ...[truncated 448 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Create the configuration directory with mode `0700`. - Create the configuration file atomically with mode `0600`. - Explicitly verify and repair permissions when an existing file is loaded or overwritten. - Reject symbolic links and non-regular files before reading or writing the credential. - Write to a securely created temporary file and atomically replace the destination. - Prefer an operating-system credential store or secret-management service rather than plaintext JSON. - Store non-sensitive settings such as the server URL separately from the API key. - Document how users can rotate a key if the configuration file was previously created with unsafe permissions. For example, open the file using flags equivalent to `O_CREAT | O_EXCL | O_WRONLY | O_NOFOLLOW` with mode `0600`, then atomically replace the intended regular file. ]]>