T09 · Insecure Skill Coding Practices
Error
- Location
- references/execution.md:67
- Finding
- Predictable Administrative Credentials and Unsafe Shell Argument Handling<![CDATA[ ## Vulnerability Details **File Location**: `references/execution.md`, line 67 **Vulnerability Type**: Hardcoded weak administrative credentials and unsafe shell command construction **Risk Level**: High ### Vulnerable Code ```bash launcheradmin.sh -adduser user:admin;login:admin;pwd:secret ``` ### Technical Analysis The deployment documentation presents an administrative account creation command containing predictable credentials: the username is `admin` and the password is `secret`. Because the command appears as an executable example without a warning or placeholder notation, an operator may copy it directly into a real environment. The credential specification is also not quoted. In POSIX-compatible shells, semicolons are command separators. The shell may therefore interpret the example as three separate commands: ```bash launcheradmin.sh -adduser user:admin login:admin pwd:secret ``` This can produce an incomplete Launcher account configuration and attempt to execute unintended commands named `login:admin` and `pwd:secret`. Even if a particular execution environment preserves the argument, the resulting administrative password remains publicly known and trivial to guess. ### Attack Path 1. An administrator follows the deployment documentation and copies the example command. 2. If the Launcher accepts the intended credential specification, an administrative account is created with the predictable `admin` / `secret` credentials. 3. The Launcher administration listener is exposed to an attacker through the host network or an incorrectly restricted management interface. 4. The attacker authenticates using the documented credentials. 5. The attacker uses Launcher administrative functions to enumerate, start, stop, import, export, or otherwise manipulate deployed map systems, subject to the privileges granted to the administrative account. Alternatively, shell interpretation of the unquoted semicolons may result in partial account creation o ...[truncated 726 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove all usable default credentials from the documentation. - Use explicit placeholders that cannot reasonably be mistaken for production values. - Quote the complete credential argument so shell metacharacters are not interpreted: ```bash launcheradmin.sh -adduser 'user:<role>;login:<unique-admin-name>;pwd:<strong-generated-secret>' ``` - Prefer an interactive password prompt or an approved secret manager instead of placing passwords in command-line arguments. Command-line secrets may be exposed through shell history, process listings, terminal logs, or automation output. - Require a unique, randomly generated password that meets the organization's password policy. - Document immediate rotation if temporary bootstrap credentials must be used. - Restrict the Launcher administration listener to a dedicated management network or localhost where possible. - Apply firewall controls, authentication rate limiting, audit logging, and least-privilege administrative roles. - Add a warning that the example is illustrative and must never be copied unchanged into production. ]]>