T09 · Insecure Skill Coding Practices
- Location
magnet-search.py:34- Finding
Global TLS Certificate and Hostname Verification Disabled
- Content
View full analysis
Vulnerability Details
File Location:
magnet-search.py, lines 34-36; the insecure context is used at lines 51-52
Vulnerability Type: Improper TLS certificate validation
Risk Level: HighVulnerable code:
python self.ssl_context = ssl.create_default_context() self.ssl_context.check_hostname = False self.ssl_context.verify_mode = ssl.CERT_NONEAffected request code:
python req = urllib.request.Request(url, headers=self.get_headers()) with urllib.request.urlopen(req, context=self.ssl_context, timeout=timeout or self.timeout) as r: data = r.read()Technical Analysis
The application creates a shared SSL context and explicitly disables both hostname checking and certificate verification. Every HTTPS request issued by
fetch()uses this context. Consequently, the client accepts an arbitrary certificate without confirming that it was issued by a trusted certificate authority or belongs to the requested host.An attacker with a suitable network interception position can impersonate configured torrent-search services, observe submitted search terms, and modify API, HTML, or RSS responses. The forged response can contain attacker-selected torrent metadata and magnet hashes. The reviewed code does not execute fetched content, so this issue alone does not establish remote code execution.
Attack Path
- A user invokes the Skill with a search query.
- The application constructs an HTTPS request to one of its configured external search services.
- An attacker able to intercept network traffic presents an arbitrary certificate and impersonates that service.
- Because certificate and hostname verification are disabled, the application accepts the attacker's TLS endpoint.
- The attacker reads the search query and returns manipulated JSON, HTML, or RSS content.
- Where the relevant parser accepts the response, the application presents attacker-controlled torrent metadata ...[truncated 511 chars]
- Remediation
View remediation
Remediation Suggestions
- Retain the secure defaults from
ssl.create_default_context()and remove both insecure assignments:python self.ssl_context = ssl.create_default_context() - Do not fall back to
ssl.CERT_NONEwhen certificate validation fails. Report the connection failure and skip the affected source. - Continue passing the verified context to
urllib.request.urlopen, or omit the custom context and use Python's secure default HTTPS behavior. - Ensure the runtime trust store is current and configure an explicit trusted CA bundle only when required.
- Add tests confirming that expired, self-signed, hostname-mismatched, and untrusted certificates are rejected.
- Consider applying response-size limits and stronger schema validation to external responses as defense in depth.
- Retain the secure defaults from