T09 · Insecure Skill Coding Practices
Error
- Location
ews-calendar.sh:116- Finding
Exchange credentials can be transmitted to an unvalidated or plaintext endpoint
- Content
View full analysis
&1) ``` ### Technical Analysis The script retrieves the Exchange password from the operating-system keyring and supplies it to `curl` for NTLM authentication. Authentication to an Exchange server is required for the declared calendar functionality, but the destination is controlled entirely through `EWS_URL`. The script does not validate that the URL: - Uses HTTPS. - Refers to an approved Exchange host. - Uses an expected port. - Is not an attacker-controlled endpoint. Consequently, a configuration error or unauthorized modification of the environment or OpenClaw configuration can cause the Skill to initiate NTLM authentication against an unintended server. NTLM does not ordinarily place the literal password directly in the HTTP request, but authentication exchanges over an untrusted connection can still enable credential capture, offline attacks, or relay attacks. A plaintext HTTP endpoint also lacks confidentiality and integrity protection for SOAP requests and responses. The network communication itself is necessary for the Skill, and no separate exfiltration endpoint was identified. The security issue is that the sensitive authentication flow is not restricted to a trusted, encrypted destination. ### Attack Path 1. An attacker who can modify the Skill environment or OpenClaw configuration changes `EWS_URL` to an attacker-controlled HTTP or HTTPS endpoint. 2. The user invokes `ews-calendar-secure.sh`. 3. The wrapper retrieves the user's Exchange password from the OS keyring and exports it as `EWS_PASS`. 4. `ews-calendar.sh` ...[truncated 897 chars]- Remediation
View remediation