T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/docker_volume_backup_or_restore.sh:77- Finding
Encryption Password Exposed Through Process Arguments and Docker Container Metadata
- Content
View full analysis
&2; exit 1; } ENCRYPT_PASSWORD="$1"; shift ;; ``` ```bash require_value "--encrypt-password" "$ENCRYPT_PASSWORD" export ENCRYPT_PASSWORD ``` ```bash docker run --rm --name "$BACKUP_CONTAINER_NAME" \ -v "$BACKUP_ARTIFACT_DIR:/artifact" \ -e ENCRYPT_PASSWORD="$ENCRYPT_PASSWORD" \ "${MOUNTS[@]}" "$HELPER_IMAGE" sh -lc ' ``` The documented invocation also encourages placing the password directly on the command line: ```bash bash docker_volume_backup_or_restore.sh \ --backup \ --encrypt-password 'your-password' ``` ### Technical Analysis The encryption password is accepted as a command-line argument. Depending on the operating system's process visibility policy, the argument may be visible in process listings or process metadata while the script is running. A command entered interactively may also remain in shell history, terminal logging, automation logs, or job-runner metadata. The script subsequently exports the password into its process environment and supplies its literal value to `docker run` using `-e ENCRYPT_PASSWORD="$ENCRYPT_PASSWORD"`. Docker records supplied environment variables in the temporary container's configuration. A user with access to the Docker daemon can inspect the container while it exists and recover the value. Although Docker access is already highly privileged on typical systems, storing a backup decryption credential in container metadata unnecessarily expands the number of interfaces through which it can be disclosed. Exporting the variable also makes it available to subsequently launched child processes. ### Attack Path 1. A ...[truncated 1339 chars]- Remediation
View remediation