T09 · Insecure Skill Coding Practices
- Location
SKILL.md:177- Finding
Publicly Exposed PostgreSQL Service Uses a Hardcoded Weak Password
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 177-185
Vulnerability Type: Hardcoded credential and unsafe network exposure
Risk Level: HighVulnerable Code
yaml db: image: postgres:13 environment: POSTGRES_PASSWORD: secret POSTGRES_DB: mydb volumes: - db-data:/var/lib/数据库/data ports: - "5432:5432"Technical Analysis
The Docker Compose example configures PostgreSQL with the predictable password
secretand publishes container port 5432 to host port 5432. Without an explicit host address, Docker normally binds the published port on all host interfaces.Because this skill presents examples intended for direct use, a user may deploy this configuration without replacing the credential or restricting network access. Any party capable of reaching the host's port 5432 can attempt to authenticate using the documented password. The risk depends on firewall rules, routing, the database user configuration, and whether the example is deployed unchanged.
Attack Path
- A user copies the Compose example from
SKILL.md. - The user starts it with
docker-compose up -d. - Docker publishes PostgreSQL port 5432 on the host.
- An attacker discovers that port through network scanning or prior knowledge.
- The attacker attempts PostgreSQL authentication using the hardcoded password
secretand likely default account assumptions. - If authentication succeeds, the attacker accesses or modifies databases according to the compromised database account's privileges.
Impact Assessment
Successful exploitation may allow unauthorized reading, alteration, or deletion of database records. It may also permit database creation, schema modification, or other operations granted to the authenticated PostgreSQL role. The direct scope is the exposed database service and its stored data; further impact depends on application trust relationships, mounted data, and database privileges.
- A user copies the Compose example from
- Remediation
View remediation
Remediation Suggestions
- Remove the hardcoded password and require secret injection through a protected environment file, Docker secret, or external secret manager.
- Do not publish PostgreSQL to the host unless external access is required.
- For local-only access, bind explicitly to loopback, for example:
yaml ports: - "127.0.0.1:5432:5432" - Prefer communication over a private Compose network between application and database services.
- Require a randomly generated, high-entropy password and ensure secret files are excluded from version control.
- Add a warning that examples must not be deployed unchanged in production.
- Apply host firewall and database access-control rules to restrict authorized source addresses and users.