T09 · Insecure Skill Coding Practices
Error
- Location
- smtp-config.example.json:2
- Finding
- Concrete SMTP Credentials Shipped in Example Configuration## Vulnerability Details **File Location**: `smtp-config.example.json:2-7` **Vulnerability Type**: Hardcoded credentials and sensitive configuration disclosure **Risk Level**: High ### Vulnerable Code ```json { "server": "192.168.50.3", "port": 8025, "username": "admin", "password": "admin1234", "emailFrom": "openclaw@njavc.com", "useTLS": false } ``` ### Technical Analysis The example configuration contains a concrete private-network SMTP address, an administrative-looking username, a plausible password, and an organization-specific sender address. These values are not clearly marked placeholders. Because configuration examples are commonly copied directly into active configuration files, the values may represent exposed credentials or may become insecure defaults. The application uses the configured username and password directly in `server.login()`, so any valid credentials grant the same SMTP access available to the application. The audit could not verify whether the private SMTP endpoint is currently reachable or whether the credentials remain valid. Exploitation therefore depends on an attacker obtaining network access to the endpoint or successfully reusing the credentials against another service. ### Attack Path 1. An attacker downloads or otherwise obtains the skill package. 2. The attacker extracts the SMTP host, port, username, password, and sender identity from `smtp-config.example.json`. 3. The attacker gains access to the `192.168.50.0/24` network through local access, VPN access, a compromised internal host, or an SSRF/pivoting primitive. Alternatively, the attacker tests the exposed credential pair against related authorized services. 4. If the endpoint is reachable and the credentials are valid, the attacker authenticates to the SMTP service. 5. The attacker sends unauthorized messages using the compromised account or configured sender identity. ### Impact Assessm ...[truncated 577 chars]
- Remediation
- ## Remediation Suggestions 1. Immediately determine whether the supplied username and password are genuine. If so, revoke or rotate them and review SMTP authentication and delivery logs for misuse. 2. Replace all concrete values with unmistakable placeholders, for example: ```json { "server": "smtp.example.com", "port": 465, "username": "SMTP_USERNAME", "password": "REPLACE_WITH_SECRET", "emailFrom": "sender@example.com", "useTLS": true } ``` 3. Store production credentials in a dedicated secret manager or inject them through protected environment variables rather than distributing them in the skill package. 4. If a JSON credential file must be used, exclude it from version control and package publication, restrict its permissions to the owning account, and verify those permissions before loading it. 5. Use a dedicated, least-privileged SMTP account with sending restrictions, rate limits, and sender-address controls. 6. Add automated secret scanning to the repository and release pipeline to prevent future credential publication.