T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
skill/skill.js:15- Finding
Unrestricted Stripe Secret Keys Are Accepted Despite Read-Only Requirements
- Content
View full analysis
Restricted Key > read:customers/subscriptions/invoices/payment_intents' } } ``` ### Technical Analysis The skill is documented as requiring a restricted, read-only Stripe key, but its validation accepts credentials beginning with either `rk_` or `sk_`. An `rk_` key is a restricted Stripe key, while an `sk_` key can be a general secret key with permissions substantially broader than the read-only operations required by this analytics function. The current code only performs read requests against Stripe. Therefore, the module does not directly use the accepted credential to modify Stripe resources. Nevertheless, allowing an unnecessarily privileged credential violates least privilege and expands the consequences of a process compromise, future code change, runtime instrumentation, or accidental credential disclosure. Prefix validation also does not verify the effective permissions granted to the key. A restricted key may still have excessive scopes, while an `sk_` key may grant account-wide capabilities. ### Attack Path 1. A user follows the configuration process but supplies a general Stripe secret key beginning with `sk_`. 2. The validation condition accepts the key even though the skill claims to require a restricted read-only key. 3. The privileged key is loaded into the skill process and transmitted in authorization headers to Stripe. 4. If the process, runtime, or future version of the skill is compromised, the attacker can capture the key. 5. The attacker can then use every permiss ...[truncated 689 chars]- Remediation
View remediation