T09 · Insecure Skill Coding Practices
Error
- Location
- ews-calendar.sh:116
- Finding
- Exchange credentials can be transmitted to an unvalidated or plaintext endpoint<![CDATA[ ## Vulnerability Details **File Location**: `ews-calendar.sh`, lines 116-122 **Vulnerability Type**: Unvalidated credential destination and missing transport security enforcement **Risk Level**: High ### Vulnerable Code ```bash response=$(curl -s -w "\n%{http_code}" \ -X POST \ -H "Content-Type: text/xml; charset=utf-8" \ --ntlm \ -u "${EWS_USER}:${EWS_PASS}" \ --data "$soap_body" \ "$EWS_URL" 2>&1) ``` ### Technical Analysis The script retrieves the Exchange password from the operating-system keyring and supplies it to `curl` for NTLM authentication. Authentication to an Exchange server is required for the declared calendar functionality, but the destination is controlled entirely through `EWS_URL`. The script does not validate that the URL: - Uses HTTPS. - Refers to an approved Exchange host. - Uses an expected port. - Is not an attacker-controlled endpoint. Consequently, a configuration error or unauthorized modification of the environment or OpenClaw configuration can cause the Skill to initiate NTLM authentication against an unintended server. NTLM does not ordinarily place the literal password directly in the HTTP request, but authentication exchanges over an untrusted connection can still enable credential capture, offline attacks, or relay attacks. A plaintext HTTP endpoint also lacks confidentiality and integrity protection for SOAP requests and responses. The network communication itself is necessary for the Skill, and no separate exfiltration endpoint was identified. The security issue is that the sensitive authentication flow is not restricted to a trusted, encrypted destination. ### Attack Path 1. An attacker who can modify the Skill environment or OpenClaw configuration changes `EWS_URL` to an attacker-controlled HTTP or HTTPS endpoint. 2. The user invokes `ews-calendar-secure.sh`. 3. The wrapper retrieves the user's Exchange password from the OS keyring and exports it as `EWS_PASS`. 4. `ews-calendar.sh` ...[truncated 897 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse and validate `EWS_URL` before retrieving or using credentials. 2. Reject every scheme except `https://` by default. 3. Support an administrator-configured allowlist of approved Exchange hostnames and ports. 4. Reject URLs containing unexpected user-info components or malformed hostnames. 5. Do not provide silent fallback to HTTP. If legacy HTTP support is unavoidable, require an explicit opt-in setting and display a prominent warning. 6. Retain normal TLS certificate validation and do not introduce `curl -k` or `--insecure`. 7. Where supported, replace NTLM/password authentication with modern token-based authentication. 8. Document that anyone able to modify `EWS_URL` can redirect the authentication attempt and must therefore be treated as having access to sensitive configuration. ]]>