Sensitive information in WinSCP.com STDOUT

Advertisement

Yllzarith
Guest

Sensitive information in WinSCP.com STDOUT

Hello,

I recently made a change to a process that is using WinSCP.com to pipe STDOUT to alert email content following a failure (STDERR has nothing in it for the case I'm about to describe). I have since noticed that the console utility's STDOUT includes clear text credentials with the "open" command.

I know there are configuration settings for hiding/removing sensitive information from WinSCP log files, but those settings seem to have no effect on STDOUT, and I haven't been able to find any information in the docs that pertains to this.

Can anyone please point me to how to address this natively (if possible)? If it cannot be addressed in the current version, I wonder if sensitive data masking could be implemented for STDOUT/ERR in future?

Here are the details of my environment based on the support template:
Version of WinSCP you are using (you should be using the latest version if possible).
I confirmed this on a production system using version 4.2.7, and checked again with the newest portable version at this time: 5.17.5

If the problem started to occur after upgrade, mention the last version of WinSCP which was working for you.
N/A

Version of Microsoft Windows you are running WinSCP on.
Production: Windows Server 2016 DC
Test: Windows 10 Professional 1903

Transfer protocol (SFTP, FTP, SCP, WebDAV or S3).
SFTP

Mention if you use GUI or scripting/automation. If you use GUI, specify interface style you are using (Commander or Explorer).
WinSCP.com

If you experience an error, include full error message. You may use Ctrl+C to copy the message, then paste it (Ctrl+V) to the post. Also check list of common error messages.
N/A

Try to describe precise steps that lead to the problem (where do you click, what keys do you press, what do you see, etc.). If you are not able to reproduce the problem with the steps, it is probably not worth to report it as I will not be able to reproduce it (and solve) too.
Particularly, if the problem relates to user interface, consider recording your steps or even full video. E.g. using Steps Recorder in Windows 7 or newer2 or Start recording function of Game bar in Windows 103 or Recordit or similar service.
Run a command with the console application, and pipe STDOUT anywhere.

If your problems relates to interaction with remote server, please post a full log file showing ...
N/A

For scripting/automation-related issues, include your full script, command-line you use to run WinSCP, and output you see on WinSCP console.
option batch abort
option confirm off
open sftp://acct:pass@sFTP.thedomain.com:22

Reply with quote

Advertisement

martin
Site Admin
martin avatar
Joined:
Posts:
33,516
Location:
Prague, Czechia

Re: Sensitive information in WinSCP.com STDOUT

So what output do you get?

When I execute a script like yours, I get an output like this:
batch           abort
confirm         off
Searching for host...
Connecting to host...
Authenticating...
Using username "username".
Authenticating ...
Authenticated.
Starting the session...
Session started.
Active session: [1] username@example.com

Are you referring to the username in the output?

Reply with quote

Yllzarith
Guest

I'm getting back the input, too:

winscp> option batch abort
batch           abort     
winscp> option confirm off
confirm         off       
winscp> open sftp://acct:pass@sFTP.thedomain.com:22
Searching for host...
Network error: Connection timed out.

Reply with quote

martin
Site Admin
martin avatar
Joined:
Posts:
33,516
Location:
Prague, Czechia

If looks like you have option echo on in your script (but your question does not show that).
https://winscp.net/eng/docs/scriptcommand_option#echo

If not, please attach a full session log file showing the problem (using the latest version of WinSCP).

To generate the session log file, use /log=C:\path\to\winscp.log command-line argument. Submit the log with your post as an attachment. Note that passwords and passphrases not stored in the log. You may want to remove other data you consider sensitive though, such as host names, IP addresses, account names or file names (unless they are relevant to the problem). If you do not want to post the log publicly, you can mark the attachment as private.

Reply with quote

Yllzarith
Guest

I checked, and confirmed I am not explicitly turning that option on. Although the default is off, I tested again with it explicitly turned off, but I see the same output.

I've attached a log file, as requested, with IP and name info masked.
  • WinSCP.log (1.94 KB, Private file)

Reply with quote

Advertisement

Yllzarith
Guest

Actually, nevermind my last post - you requested a session log file showing the problem, but the log file never shows the input commands. The problem only manifests in the process output.

Reply with quote

martin
Site Admin
martin avatar

You are using 10 years old version of WinSCP (4.2.7). Please upgrade to the latest version and post a new log file. And show us how exactly are you running WinSCP script.

Reply with quote

Advertisement

You can post new topics in this forum