{"action":"opened","issue":{"url":"https://api.github.com/repos/StackStorm/st2-packages/issues/558","repository_url":"https://api.github.com/repos/StackStorm/st2-packages","labels_url":"https://api.github.com/repos/StackStorm/st2-packages/issues/558/labels{/name}","comments_url":"https://api.github.com/repos/StackStorm/st2-packages/issues/558/comments","events_url":"https://api.github.com/repos/StackStorm/st2-packages/issues/558/events","html_url":"https://github.com/StackStorm/st2-packages/issues/558","id":326129430,"number":558,"title":"StackStorm credentials leak from '~/.st2/config'","user":{"login":"armab","id":1533818,"avatar_url":"https://avatars2.githubusercontent.com/u/1533818?v=4","gravatar_id":"","url":"https://api.github.com/users/armab","html_url":"https://github.com/armab","followers_url":"https://api.github.com/users/armab/followers","following_url":"https://api.github.com/users/armab/following{/other_user}","gists_url":"https://api.github.com/users/armab/gists{/gist_id}","starred_url":"https://api.github.com/users/armab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/armab/subscriptions","organizations_url":"https://api.github.com/users/armab/orgs","repos_url":"https://api.github.com/users/armab/repos","events_url":"https://api.github.com/users/armab/events{/privacy}","received_events_url":"https://api.github.com/users/armab/received_events","type":"User","site_admin":false},"labels":[{"id":705501069,"url":"https://api.github.com/repos/StackStorm/st2-packages/labels/bash%20installer","name":"bash installer","color":"000000","default":false},{"id":229286658,"url":"https://api.github.com/repos/StackStorm/st2-packages/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-05-24T13:46:07Z","updated_at":"2018-05-24T13:46:07Z","closed_at":null,"author_association":"MEMBER","body":"`curl|bash` installer creates a `~/.st2/config` file containing StackStorm login creds with read-all permissions:\r\n\r\n```\r\n$ ls -la ~/.st2/config \r\n-rw-r--r-- 1 vagrant vagrant 54 May 23 14:09 /home/vagrant/.st2/config\r\n```\r\n\r\nThis way unauthorized Linux user can read st2 login creds `username:password` saved by the other user.\r\n\r\n----\r\n\r\nIdeally, `~/.st2/` dir should have also `2750` permissions, (currently `0755`)."}}
{"actor":{"display_login":"armab"}}