T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/pager-triage.sh:77
- Finding
- PagerDuty API Token Exposed Through Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/pager-triage.sh:77-99` **Vulnerability Type**: Credential exposure through command-line arguments **Risk Level**: Medium ### Vulnerable Code ```bash local -a curl_args=( -s -w '\n%{http_code}' --max-time "$CURL_TIMEOUT" -H "Authorization: Token token=${PAGERDUTY_API_KEY}" -H "Content-Type: application/json" -X "$method" ) # Add From header for write operations if [[ "$method" != "GET" && -n "${PAGERDUTY_EMAIL:-}" ]]; then curl_args+=(-H "From: ${PAGERDUTY_EMAIL}") fi if [[ -n "$data" ]]; then curl_args+=(-d "$data") fi local response http_code body local attempt=0 local max_attempts=2 while (( attempt < max_attempts )); do response=$(curl "${curl_args[@]}" "$url" 2>/dev/null) || { ``` ### Technical Analysis The PagerDuty API token is expanded into the `curl` argument array and passed as an HTTP header using `-H`. Although the token originates from an environment variable, its expanded value becomes part of the `curl` process argument vector. On systems where process arguments are visible to other local users, diagnostic agents, container administrators, or monitoring software, the complete authorization header may be recovered while the request is running. This contradicts the assertion in `SECURITY.md` that credentials are never passed through command-line arguments. The same issue applies to `PAGERDUTY_EMAIL` during write requests, although disclosure of the API token presents the greater security risk. ### Attack Path 1. A legitimate user or agent invokes a PagerDuty command such as `incidents` or `detail`. 2. The script expands `PAGERDUTY_API_KEY` into the `curl` command-line argument containing the authorization header. 3. During the request, an attacker with sufficient same-host process visibility inspects the `curl` process through facilities such as `/proc`, process monitoring, container administration, or telemetry collection. 4. The attacker extracts the complete ...[truncated 1057 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not place the authorization header directly in the `curl` argument vector. - Supply sensitive curl configuration through standard input or a protected file descriptor so the token is not present in process arguments. For example, generate a curl configuration stream with restrictive handling and invoke `curl --config -`. - Avoid temporary files where possible. If a temporary credential-bearing configuration is unavoidable, create it with mode `0600`, place it in a trusted directory, install an exit trap, and securely remove it immediately after use. - Ensure tracing is disabled around credential processing and document that the script must not be run with `bash -x`. - Prevent command and process telemetry systems from collecting sensitive header values. - Prefer read-only, team-scoped API tokens for normal triage. Use a separate narrowly scoped token or execution context for write operations. - Add an automated test that observes the child process arguments and fails if the API token or email appears. - Update `SECURITY.md` so its credential-handling claims accurately reflect the implementation. ]]>