T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:27
- Finding
- Umami Administrator Password Exposed in Shell Command Arguments and History<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27–30 **Vulnerability Type**: Plaintext credential exposure **Risk Level**: Medium ```bash TOKEN=$(curl -s -X POST "https://<UMAMI_HOST>/api/auth/login" \ -H "Content-Type: application/json" \ -d '{"username":"admin","password":"<PASSWORD>"}' \ | python3 -c "import json,sys; print(json.load(sys.stdin)['token'])") ``` ### Technical Analysis The instructions encourage the operator to substitute the Umami administrator password directly into a command-line argument. If entered literally, the credential may be retained in the user's shell history. While the command is executing, the password may also be visible through operating-system process inspection interfaces to other sufficiently privileged local users or processes. The resulting bearer token is stored in the `TOKEN` shell variable and reused by subsequent API requests. This is functionally necessary for authentication, but it extends the lifetime of sensitive authentication material within the shell environment. No hardcoded real credential is included in the project; the risk arises from the documented credential-handling pattern. ### Attack Path 1. An operator replaces `<PASSWORD>` with the real Umami administrator password and runs the documented command. 2. The literal command is recorded in shell history or becomes temporarily available through local process-argument inspection. 3. A local attacker, malicious process, or another account with sufficient access reads the exposed credential. 4. The attacker authenticates to the configured Umami instance using the administrator credentials. 5. The attacker accesses or modifies websites and analytics data within the permissions granted to that administrator account. This attack requires access to the operator's local shell history, account, or process information; the documentation does not independently transmit the credential to an unrelated third party. ### Impact Ass ...[truncated 633 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not place the administrator password literally in an interactive command. - Prompt for the password without terminal echo, for example with `read -r -s`, and construct the request body without exposing the secret as a command-line argument. - Prefer reading the JSON request body from standard input or a securely permissioned temporary descriptor rather than passing it through `curl -d`. - Avoid insecure temporary files. If a temporary file is unavoidable, create it with restrictive permissions, ensure exclusive creation, and delete it immediately after use. - Use a narrowly scoped API credential instead of an administrator password if the Umami deployment supports scoped tokens or service accounts. - Disable command-history recording for the sensitive operation or ensure that no secret appears in the command text. - Clear sensitive shell state after completing the operation, such as with `unset PASSWORD TOKEN`. - Document token expiration, revocation, and rotation procedures. - Run the setup from a trusted workstation and ensure that access to process information and shell-history files is appropriately restricted. ]]>