https://labs.f-secure.com/blog/jamfing-for-joy-attacking-macos-in-enterprise/

Just a small portion of the blog post by F-Secure which talks about the popular workaround that Jamf admins use to obscure passwords: https://github.com/jamf/Encrypted-Script-Parameters

The other case we commonly find is credentials passed into the script as arguments. In the JSS this looks something like this. Whilst these credentials don’t get written to disk, if we look at the process listings when a script is executing, we observe something similar to this. This is great news for us! The arguments are passed to the script like any other program, which means we can read them straight out of the process listings. Even better, we’re able to pull this information from a low privilege account, as even a low privilege account can see the processes and arguments of processes executing as root using the utility ps. We’ve seen local administrator credentials passed to devices in this way, so in the right environment this could serve as a handy privesc. ..... We wanted to give a special nod to the final case we’ve observed in the wild. In this variant, we can see encrypted versions of the credentials stored in the arguments, and all the necessary information to decrypt the credential in the body of the script itself. We’ve seen two reasons that organisations are doing this. Firstly, this prevents everyone with access to the JSS from being able to view (potentially privileged) plaintext credentials. Alternatively, this prevents a SIEM collecting process logs from recording the credential in plaintext. Whilst this solution effectively combats both of these issues, from an attackers perspective, this provides no added benefit as we have access to both data sources. .....

It would be nice if Jamf addressed this finally. They've ignored it for a while now despite definitely folks saying that the Encrypted Script Parameters workaround wasn't fully secure.

My feature request is a duplicate of first one linked below, but in it I'm specifically asking for the ability to obscure script parameter fields and to also encrypt the parameter. Some of these feature requests are about 3 to 4 years old now.

I'm hoping now that a security company has blogged about this that Jamf will give Jamf Script parameters a bit more priority and love.

Here are some feature requests related to script parameters that would give script parameters some nice improvements:
1. https://www.jamf.com/jamf-nation/feature-requests/4355/hide-script-parameter-option-for-password
2. https://www.jamf.com/jamf-nation/feature-requests/3630/more-script-parameters
3. https://www.jamf.com/jamf-nation/feature-requests/5889/allow-longer-script-arguments-and-argument-descriptions-with-error-checking
4. https://www.jamf.com/jamf-nation/feature-requests/7091/add-text-descriptions-to-script-parameters
5. https://www.jamf.com/jamf-nation/feature-requests/5797/increase-character-limit-for-parameters-to-65535
6. https://www.jamf.com/jamf-nation/feature-requests/3988/script-parameter-types-mandatory-parameters

Vote these all up and add your comments.

Hoping Jamf is able to respond to this security issue in a prompt manner.