Spotipy's cache file, containing spotify auth token, is created with overly broad permissions
Date: 2025-02
Affected: pip/spotipy
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-27154
CWE: CWE-276

### Summary The `CacheHandler` class creates a cache file to store the auth token here: https://github.com/spotipy-dev/spotipy/blob/master/spotipy/cache_handler.py#L93-L98 The file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw-------` (600) permissions. I think `600` is a sensible default. ![image](https://github.com/user-attachments/assets/0b7ebbc1-a27a-4528-ab6a-135c7886766a) ### Details This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. ### PoC Run an application that uses spotipy with client creation like this: ```python from pathlib import Path import spotipy from os import getenv def create_spotify_client(client_id: str, client_secret: str) -> spotipy.Spotify: """Create and return an authenticated Spotify client. Args: client_id: Spotify API client ID client_secret: Spotify API client secret Returns: An authenticated Spotify client instance """ cache_path = Path.home() / ".cache" / "spotify-backup/.auth_cache" cache_path.parent.mkdir(parents=True, exist_ok=True) cache_handler = spotipy.cache_handler.CacheFileHandler(cache_path=str(cache_path)) client = spotipy.Spotify( auth_manager=spotipy.oauth2.SpotifyOAuth(


Mitigations:

Architectural layers (MAESTRO):