T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/cf-global.sh:7
- Finding
- Global API Key Exposed Through Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cf-global.sh`, lines 7-15 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash CF_API="https://api.cloudflare.com/client/v4" AUTH=(-H "X-Auth-Email: ${CLOUDFLARE_EMAIL}" -H "X-Auth-Key: ${CLOUDFLARE_GLOBAL_API_KEY}" -H "Content-Type: application/json") cf_request() { local method="$1" path="$2" data="${3:-}" if [[ -n "$data" ]]; then curl -fsS -X "$method" "${AUTH[@]}" -d "$data" "$CF_API$path" else curl -fsS -X "$method" "${AUTH[@]}" "$CF_API$path" fi } ``` ### Technical Analysis The script expands `X-Auth-Key` and `X-Auth-Email` directly into the argument vector of every spawned `curl` process. On systems where process command lines are visible through process inspection interfaces, monitoring agents, diagnostic tooling, or command telemetry, the complete Global API Key may be exposed while `curl` is running. This issue is particularly significant because a Cloudflare Global API Key is a highly privileged account-level credential. Although the request is sent over HTTPS to the legitimate Cloudflare API, transport encryption does not protect the credential from local process inspection before transmission. Exploitation requires local access to process metadata or access to monitoring or logging infrastructure that captures process arguments. ### Attack Path 1. A legitimate user configures `CLOUDFLARE_GLOBAL_API_KEY` and runs an operation through `cf-global.sh`. 2. The script creates a `curl` process with the API key embedded in an `-H` command-line argument. 3. A local user, process-monitoring agent, diagnostic collector, or compromised administrative tool records the process argument vector. 4. The observer extracts the value following `X-Auth-Key:`. 5. The stolen Global API Key and associated account email are reused to authenticate directly to Cloudflare. 6. The attacker performs operations per ...[truncated 813 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not place authentication secrets directly in command-line arguments. - Provide sensitive curl headers through a protected temporary configuration file or file descriptor that is readable only by the current user. - If a temporary file is used: - Create it with restrictive permissions such as mode `0600`. - Use a securely created unpredictable path. - Install an exit trap to remove it on normal termination and errors. - Avoid shared or predictable temporary filenames. - Disable implicit curl configuration loading with `--disable` to prevent unexpected behavior from user-controlled curl configuration. - Ensure monitoring and debug tooling does not capture authentication headers. - Prefer narrowly scoped Cloudflare API tokens over the legacy Global API Key. - Rotate the Global API Key if process telemetry or command-line logs may already have captured it. ]]>