T09 · Insecure Skill Coding Practices
Error
- Location
- email_sender.py:137
- Finding
- SMTP Credentials and Message Content Can Be Transmitted Without Encryption## Vulnerability Details **File Location**: `email_sender.py`, lines 137-155 **Vulnerability Type**: Optional plaintext SMTP authentication and transmission **Risk Level**: High ### Vulnerable Code ```python # Connect to SMTP server context = ssl.create_default_context() if self.config.get('use_ssl', False): # SSL connection server = smtplib.SMTP_SSL( self.config['smtp_server'], self.config['smtp_port'], context=context ) else: # TLS connection (default) server = smtplib.SMTP( self.config['smtp_server'], self.config['smtp_port'] ) if self.config.get('use_tls', True): server.starttls(context=context) # Login and send server.login(self.config['username'], self.config['password']) server.send_message(msg, from_addr=self.config['username'], to_addrs=all_recipients) ``` ### Technical Analysis The application permits both `use_ssl` and `use_tls` to be disabled. When this occurs, it creates a plaintext SMTP connection and proceeds to call `server.login()` without first establishing an encrypted transport. Depending on the authentication mechanisms supported by the SMTP server, the username and password may be transmitted in a trivially decodable form. Message headers, recipient addresses, body content, and attachments are also exposed to interception or modification. Although TLS is enabled by default, secure transport is not enforced. An unsafe configuration, such as `EMAIL_USE_TLS=false` with `EMAIL_USE_SSL=false`, is sufficient to activate the vulnerable path. The code does not reject this configuration or verify that encryption is active before authenticating. ### Attack Path 1. The Skill is deployed with `use_ssl` and `use_tls` disabled, whether through an explicit environment setting, an integration error, or an unsafe custom SMTP configuration. 2. The Skill creates a standard plaintext `smtplib.SMTP` connection. ...[truncated 1149 chars]
- Remediation
- ## Remediation Suggestions - Reject configurations in which both `use_ssl` and `use_tls` are disabled. - Make encrypted transport mandatory before calling `login()` or transmitting a message. - Prefer implicit TLS through `SMTP_SSL` on an appropriate port or mandatory STARTTLS with a default certificate-verifying SSL context. - After calling `starttls()`, issue `ehlo()` again and ensure the operation completed successfully before authentication. - Fail closed if the SMTP server does not advertise STARTTLS or if certificate validation fails. - Consider replacing the two booleans with a single validated transport mode, such as `implicit_tls` or `starttls`, to prevent contradictory settings. - Add tests confirming that plaintext authentication is impossible under every configuration combination. - Document that disabling certificate verification or encrypted transport is unsupported. Example validation: ```python use_ssl = self.config.get('use_ssl', False) use_tls = self.config.get('use_tls', True) if not use_ssl and not use_tls: raise ValueError("Encrypted SMTP transport is required") ```