T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config_loader.py:286- Finding
RPC Credentials Can Be Transmitted Over Unencrypted HTTP or WebSocket Connections
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config_loader.py:286-313,scripts/rpc_client.py:56-62, 77-79, 119-137,scripts/websocket_client.py:65-70, 87-89, 166-181
Vulnerability Type: Plaintext transmission of sensitive authentication data
Risk Level: MediumVulnerable Code
scripts/config_loader.py:286-313:python # Build URL protocol = "https" if self.config["secure"] else "http" path = self.config.get("path") or "" url = f"{protocol}://{self.config['host']}:{self.config['port']}{path}" # Create a simple test request (aria2.getVersion) request_data = { "jsonrpc": "2.0", "id": "test-connection", "method": "aria2.getVersion", "params": [], } # Add token if configured if self.config.get("secret"): request_data["params"].insert(0, f"token:{self.config['secret']}") try: req = urllib.request.Request( url, data=json.dumps(request_data).encode("utf-8"), headers={"Content-Type": "application/json"}, ) timeout_sec = self.config["timeout"] / 1000.0 response = urllib.request.urlopen(req, timeout=timeout_sec)scripts/rpc_client.py:56-62, 77-79, 119-137:python def _build_endpoint_url(self) -> str: """Build the full RPC endpoint URL.""" protocol = "https" if self.config.get("secure", False) else "http" host = self.config["host"] port = self.config["port"] path = self.config.get("path") or "" return f"{protocol}://{host}:{port}{path}" def _inject_token(self, params: List[Any]) -> List[Any]: secret = self.config.get("secret") if secret: return [f"token:{secret}"] + params return params request_data = json.dumps(request).encode("utf-8") req = urllib.request.Request( self.endpoint_url, data=request_data, headers={ "Content-Type": "application/json", "User-Agent": "aria2-json-rpc-client/1.0", } ...[truncated 2893 chars]- Remediation
View remediation
Remediation Suggestions
- Reject configurations that combine a non-loopback host, a nonempty secret, and
secure=false. - Permit plaintext authenticated transport only for verified loopback addresses such as
127.0.0.1and::1. - If legacy remote plaintext support is unavoidable, require a clearly named explicit override such as
allow_insecure_remote_auth, disabled by default. - Emit a prominent warning before any insecure connection attempt; do not rely solely on documentation.
- Default remote configurations to HTTPS/WSS and document certificate validation requirements.
- Consider separating local and remote configuration profiles so that a local plaintext default cannot be accidentally reused for a remote server.
- Add tests confirming that secrets cannot be sent over HTTP or WS to non-loopback destinations without explicit authorization.
- Reject configurations that combine a non-loopback host, a nonempty secret, and