T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
capture-new-browser.js:6- Finding
Overbroad Collection of Secrets from the User Shell Configuration
- Content
View full analysis
{ const match = line.match(/export\s+([A-Z_]+)=(.+)/); if (match && !process.env[match[1]]) { process.env[match[1]] = match[2].replace(/^["']|["']$/g, ''); } }); } } } catch (e) { // Ignore errors } } // Load environment variables at startup loadEnvFromZshrc(); ``` ### Technical Analysis The recommended executable reads the user's complete `~/.zshrc` file and imports every uppercase exported variable into the Node.js process. The declared AI functionality only requires `DASHSCOPE_API_KEY`; reading unrelated variables is not necessary. Shell configuration files commonly contain cloud credentials, database passwords, deployment tokens, proxy credentials, and other secrets. Importing all such values unnecessarily expands the sensitive information available to this process, its dependencies, diagnostic output, and any subsequently introduced or exploited code. The broad collection does not itself transmit every imported value, and the audit found no code that deliberately uploads the complete environment. Nevertheless, it violates least privilege and increases the impact of another vulnerability in the same process. ### Attack Path 1. A user stores unrelated credentials as uppercase exports in `~/.zshrc`. 2. The user runs the recommended `capture-new-browser.js` script. 3. The script reads ...[truncated 663 chars]- Remediation
View remediation