T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/active_directory.py:25
- Finding
- Fabricated High-Severity Findings Presented as Validated Test Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/active_directory.py`, lines 25–26 and 40–45 **Vulnerability Type**: Insecure result generation and integrity failure **Risk Level**: Medium ### Vulnerable Code ```python def build_finding(target:str)->dict: return {'finding_id':f"{SKILL_NAME.replace('-', '_')}-001",'skill':SKILL_NAME,'timestamp':datetime.now(timezone.utc).isoformat(),'target':target,'title':'Pentest Active Directory identified a security weakness','cve':'N/A','cwe':'CWE-693','cvss_score':8.0,'cvss_vector':'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L','owasp_category':'A05:2021 - Security Misconfiguration','mitre_attack':'TA0006, TA0008','severity':'High','description':'Automated and manual testing identified a security condition requiring remediation.','proof_of_concept':'python scripts/active_directory.py --dry-run','screenshot':'assets/findings/placeholder.png','remediation':'Apply least privilege, secure defaults, and verify fixes with retest.','references':["https://github.com/BloodHoundAD/BloodHound", "https://github.com/BloodHoundAD/SharpHound"],'status':'open'} def main()->int: args=parse_args() scope_ok,scope_meta=validate_scope(args.target,args.scope) report_path=resolve_output_file(args.output,args.format,REPORT_STEM) if not scope_ok: r={'status':'error','summary':'TARGET NOT IN AUTHORIZED SCOPE - ABORTING','artifacts':[str(report_path)],'details':{'skill':SKILL_NAME,'target':args.target,'scope':scope_meta,'dry_run':args.dry_run}} render_result(r,report_path,args.format); print(json.dumps(r,indent=2)); return 1 if not args.i_have_authorization and not args.dry_run: r={'status':'error','summary':'You must pass --i-have-authorization to confirm written authorization.','artifacts':[str(report_path)],'details':{'skill':SKILL_NAME,'target':args.target,'scope':scope_meta,'dry_run':args.dry_run}} render_result(r,report_path,args.format); print(json.dumps(r,indent=2)); re ...[truncated 3171 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional call to `build_finding()` and do not produce a vulnerability unless a specific test has generated verifiable evidence. 2. Implement the documented Active Directory assessment checks under the existing scope and authorization controls. 3. Define explicit detection criteria for each supported weakness, including required observations, affected objects, test commands, timestamps, and evidence. 4. Generate findings only when those criteria are satisfied. If no checks are implemented or no weakness is detected, return an explicit `not_tested` or `no_findings` state. 5. Separate synthetic fixtures from production findings. Placeholder results should be clearly labeled as test data and must not use `open` status, High severity, or language claiming that testing identified a weakness. 6. Replace the dry-run command currently presented as a proof of concept with reproducible, finding-specific evidence that does not expose credentials or other sensitive information. 7. Add schema fields identifying the executed check, evidence source, validation status, and confidence level. 8. Add automated tests confirming that arbitrary or empty input cannot produce a vulnerability and that dry-run mode never represents placeholder output as an observed finding. 9. Ensure downstream artifacts distinguish among validated findings, informational observations, skipped checks, and execution errors. ]]>