T09 · Insecure Skill Coding Practices
Error
- Location
drop.js:66- Finding
Plaintext Unauthenticated Secret Receiver Exposed on All Network Interfaces
- Content
View full analysis
{ if (req.method === 'GET') { res.writeHead(200, { 'Content-Type': 'text/html' }); res.end(html); } else if (req.method === 'POST') { let body = ''; req.on('data', c => body += c); req.on('end', () => { res.writeHead(200); res.end('ok'); // Write secret to file (NOT stdout!) fs.writeFileSync(OUTPUT, body.trim(), { mode: 0o600 }); console.log(`\n✓ Secret received and saved.`); console.log(` File: ${OUTPUT}`); console.log(` (Secret is NOT printed to stdout for security)`); server.close(() => process.exit(0)); }); } }); // Start server.listen(PORT, '0.0.0.0', () => { const ips = getLocalIPs(); console.log(`🍒 Side_Peace waiting...`); console.log(` Label: ${LABEL}`); console.log(` Output: ${OUTPUT}\n`); console.log(` Local: http://localhost:${PORT}`); ips.forEach(ip => console.log(` Network: http://${ip}:${PORT}`)); console.log(`\nWaiting for secret...`); }); ``` ### Technical Analysis The server binds to `0.0.0.0`, making the secret receiver accessible through every available network interface. It uses unencrypted HTTP and accepts any POST request without authentication, a one-time capability token, source restrictions, or request-origin validation. Although receiving a secret over the network is part of the declared functionality, exposure to the entire local network exceeds the minimum privilege needed for a same-device browser handoff. The implementation also treats the first POST request as authoritative and shuts down after processing it. The detected network transmission is therefore functional rather than concealed external exfiltration, but it lacks the controls ...[truncated 1246 chars]- Remediation
View remediation