T09 · Insecure Skill Coding Practices
- Location
acumaticahelper.sh:149- Finding
Cleartext Transport Permitted for Credentials and Authenticated Sessions
- Content
View full analysis
Vulnerability Details
File Location:
acumaticahelper.sh:20, 149-157; insecure examples also appear inSKILL.md:24-26andREADME.md:27-30
Vulnerability Type: Cleartext transmission of sensitive information
Risk Level: HighVulnerable Code
bash # Configuration — stored in acumatica.conf (same directory as this script): # ACUMATICA_URL=http://host/instance # ACUMATICA_USERNAME=admin # ACUMATICA_PASSWORD=secretbash response_body=$(curl -s -w "\n%{http_code}" \ -c "$_COOKIE_FILE" \ -X POST \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ -d "$payload" \ "${ACUMATICA_URL}/entity/auth/login")The documentation reinforces this insecure configuration:
ini ACUMATICA_URL=http://host/instance ACUMATICA_USERNAME=admin ACUMATICA_PASSWORD=secretTechnical Analysis
The script accepts an arbitrary
ACUMATICA_URLand does not require thehttps://scheme. Its own configuration examples explicitly usehttp://. During login, the username and password are inserted into a JSON request body and transmitted to${ACUMATICA_URL}/entity/auth/login. All subsequent authenticated API requests send the resulting session cookie to the same origin.When HTTP is used, neither the credentials nor the session cookie receive transport confidentiality or server authentication. A network-positioned attacker can observe the login request, steal the cookie, modify API responses, or tamper with authenticated requests. Quoting shell variables and using JSON encoding do not mitigate transport-layer interception.
Attack Path
- An administrator follows the provided example and configures
ACUMATICA_URLwith anhttp://URL. - The administrator invokes any command, causing
_loginto send the configured username and password over cleartext HTTP. - An attacker positioned on the same network, an upstream gateway, or another traffic-observation point captures the credentials or sess ...[truncated 820 chars]
- An administrator follows the provided example and configures
- Remediation
View remediation
Remediation Suggestions
- Require
ACUMATICA_URLto begin withhttps://and reject cleartext HTTP before authentication:
bash case "$ACUMATICA_URL" in https://*) ;; *) echo "Error: ACUMATICA_URL must use HTTPS." >&2 return 1 ;; esac- If HTTP is indispensable for isolated local development, require an explicit opt-in such as
ALLOW_INSECURE_HTTP=true, restrict it to loopback addresses where practical, and display a prominent warning. It should never be the default. - Replace every
http://configuration example inacumaticahelper.sh,README.md, andSKILL.mdwithhttps://. - Keep curl certificate verification enabled. Do not add
-kor--insecure; configure the correct private certificate authority using--cacertwhen an internal CA is used. - Use a dedicated, least-privileged Acumatica account restricted to only the necessary instance and operations.
- Protect
acumatica.confwith owner-only permissions, avoid committing it to source control, and rotate credentials that may previously have traversed an untrusted HTTP connection. - Consider enforcing secure-cookie attributes and short session lifetimes on the Acumatica server as defense in depth.
- Require