T09 · Insecure Skill Coding Practices
Error
- Location
- main.py:81
- Finding
- WordPress credentials may be transmitted over plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `main.py:81-84, 288-300, 337-350`; related defaults in `config.json:2-9`, `SKILL.md:556-579`, and `README.md:559-573` **Vulnerability Type**: Plaintext transmission of authentication credentials **Risk Level**: High ### Vulnerable Code ```python # Set default values for airoom.ltd financial data platform if "wordpress" not in config: config["wordpress"] = { "url": "http://airoom.ltd", "username": "", "password": "" } if "target" not in config: config["target"] = { "page_url": "http://airoom.ltd/index.php/airoom/" } ``` When authentication is required, the same configurable base URL is used to construct the login endpoint: ```python if requires_login and username and password: print("\n[Step 2] Logging into WordPress...") login_url = f"{base_url}/wp-login.php" try: page.goto(login_url, wait_until="domcontentloaded", timeout=30000) print("Entering login credentials...") page.fill("#user_login", username) page.fill("#user_pass", password) page.click("#wp-submit") ``` The shipped configuration also uses plaintext HTTP: ```json { "wordpress": { "url": "http://airoom.ltd", "username": "", "password": "" }, "target": { "page_url": "http://airoom.ltd/index.php/airoom/" } } ``` ### Technical Analysis The downloader supports optional WordPress authentication, but neither configuration validation nor login handling requires HTTPS. The default `WP_URL` uses `http://`, and the login endpoint is created by appending `/wp-login.php` to that value. Although the documented target page is public, authenticated pages are explicitly supported. Consequently, a user who configures a username and password can cause the Skill to submit those credentials over an unencrypted HTTP connection. Host equality checks do not provide transport confidentiality or server authentication. They do not prevent int ...[truncated 1212 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require `https` whenever credentials are present: ```python parsed_base = urlparse(base_url) if username or password: if parsed_base.scheme.lower() != "https": raise ValueError("HTTPS is required when WordPress credentials are configured") ``` 2. Prefer requiring HTTPS for all network access, including public downloads. 3. Reject redirects from HTTPS to HTTP and verify the final URL after every navigation. 4. Remove plaintext HTTP defaults from `main.py`, `config.json`, `SKILL.md`, and `README.md`. 5. Do not submit credentials when the login origin differs from the explicitly approved origin. 6. Consider removing authenticated-page support entirely because the declared default functionality only needs a public page. 7. Encourage dedicated, least-privileged WordPress accounts when authentication is unavoidable. ]]>