T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- skill/skill.js:15
- Finding
- Unrestricted Stripe Secret Keys Are Accepted Despite Read-Only Requirements<![CDATA[ ## Vulnerability Details **File Location**: `skill/skill.js:15-20` **Vulnerability Type**: Insufficient credential privilege validation **Risk Level**: Medium ### Complete Code Snippet ```javascript if (!process.env.STRIPE_READ_KEY || !(process.env.STRIPE_READ_KEY.startsWith('sk_') || process.env.STRIPE_READ_KEY.startsWith('rk_'))) { return { status: 'error', error_type: 'auth_error', message: 'STRIPE_READ_KEY invalid. Use Stripe Dashboard > Restricted Key > read:customers/subscriptions/invoices/payment_intents' } } ``` ### Technical Analysis The skill is documented as requiring a restricted, read-only Stripe key, but its validation accepts credentials beginning with either `rk_` or `sk_`. An `rk_` key is a restricted Stripe key, while an `sk_` key can be a general secret key with permissions substantially broader than the read-only operations required by this analytics function. The current code only performs read requests against Stripe. Therefore, the module does not directly use the accepted credential to modify Stripe resources. Nevertheless, allowing an unnecessarily privileged credential violates least privilege and expands the consequences of a process compromise, future code change, runtime instrumentation, or accidental credential disclosure. Prefix validation also does not verify the effective permissions granted to the key. A restricted key may still have excessive scopes, while an `sk_` key may grant account-wide capabilities. ### Attack Path 1. A user follows the configuration process but supplies a general Stripe secret key beginning with `sk_`. 2. The validation condition accepts the key even though the skill claims to require a restricted read-only key. 3. The privileged key is loaded into the skill process and transmitted in authorization headers to Stripe. 4. If the process, runtime, or future version of the skill is compromised, the attacker can capture the key. 5. The attacker can then use every permiss ...[truncated 689 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Reject general Stripe secret keys and require a restricted key: ```javascript const key = process.env.STRIPE_READ_KEY if (!key || !key.startsWith('rk_')) { return { status: 'error', error_type: 'auth_error', message: 'A restricted Stripe read-only key is required.' } } ``` 2. Document the minimum required read scopes precisely and keep all write scopes disabled. 3. Where supported, validate the key's effective permissions during setup and fail closed when required scopes are absent or unnecessary scopes are present. 4. Store the key in a dedicated secret manager rather than plaintext configuration. 5. Ensure the environment variable is not inherited by unrelated child processes. 6. Add automated tests confirming that `sk_` keys and malformed credentials are rejected. 7. Rotate any unrestricted secret key previously supplied to the skill and replace it with a narrowly scoped restricted key. ]]>