T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/register.sh:49
- Finding
- Persistent Device Identifier Collected and Transmitted to an External Service<![CDATA[ ## Vulnerability Details **File Location**: `scripts/register.sh:49-85`, `scripts/register.sh:174-199` **Vulnerability Type**: Excessive collection and external transmission of a stable device identifier **Risk Level**: Medium ### Vulnerable Code ```bash get_device_uuid() { local uuid="" if [[ "$OSTYPE" == "darwin"* ]]; then if command -v ioreg >/dev/null 2>&1; then uuid=$(ioreg -rd1 -c IOPlatformExpertDevice 2>/dev/null | awk -F'"' '/IOPlatformUUID/ {print $4; exit}') fi elif [[ "$OSTYPE" == "linux"* ]] || [[ "$OSTYPE" == "gnu"* ]]; then if [ -r /sys/class/dmi/id/product_uuid ]; then uuid=$(cat /sys/class/dmi/id/product_uuid 2>/dev/null) elif [ -r /etc/machine-id ]; then uuid=$(cat /etc/machine-id 2>/dev/null) fi elif [[ "$OSTYPE" == "msys"* ]] || [[ "$OSTYPE" == "cygwin"* ]] || [[ "$OSTYPE" == "win32"* ]]; then if command -v powershell.exe >/dev/null 2>&1; then uuid=$(powershell.exe -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID" 2>/dev/null | tr -d '\r') elif command -v pwsh >/dev/null 2>&1; then uuid=$(pwsh -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID" 2>/dev/null | tr -d '\r') elif command -v wmic >/dev/null 2>&1; then uuid=$(wmic csproduct get UUID 2>/dev/null | awk 'NF && $0 !~ /UUID/ {print; exit}') fi else if [ -r /sys/class/dmi/id/product_uuid ]; then uuid=$(cat /sys/class/dmi/id/product_uuid 2>/dev/null) elif [ -r /etc/machine-id ]; then uuid=$(cat /etc/machine-id 2>/dev/null) fi fi uuid=$(echo "$uuid" | tr -d '[:space:]"') echo "$uuid" } ``` ```bash local device_uuid_used=false if [ -z "$username" ]; then local device_uuid device_uuid=$(get_device_uuid) if [ -n "$device_uuid" ]; then username="$device_uuid" device_uuid_used=true el ...[truncated 2892 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `get_device_uuid` and never access DMI UUIDs, `/etc/machine-id`, macOS platform UUIDs, or Windows hardware UUIDs for this workflow. 2. Generate a cryptographically random, application-specific pseudonymous identifier instead: ```bash generate_client_id() { if command -v openssl >/dev/null 2>&1; then openssl rand -hex 16 else tr -dc 'a-f0-9' </dev/urandom | head -c 32 fi } ``` 3. Use the generated value only for the minimum period required by the service. 4. If a persistent client identifier is necessary, store a random application identifier in a permission-restricted file rather than deriving it from the host. 5. Do not return or cache a `device_uuid` field. 6. Require explicit, informed user consent before collecting any persistent device identifier. 7. Document the external service operator, the transmitted fields, retention policy, and privacy policy. 8. Add automated tests that fail if the registration script accesses known machine-identity resources. ]]>