T09 · Insecure Skill Coding Practices
Error
- Location
- aggregate_feeds.py:58
- Finding
- TLS Certificate and Hostname Verification Disabled<![CDATA[ ## Vulnerability Details **File Location**: `aggregate_feeds.py:58-68` **Vulnerability Type**: Improper certificate validation (CWE-295) **Risk Level**: High ### Complete Code Snippet ```python try: # Create SSL context that doesn't verify certificates (for testing) ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE req = urllib.request.Request( url, headers={"User-Agent": USER_AGENT} ) with urllib.request.urlopen(req, timeout=30, context=ctx) as response: content = response.read().decode("utf-8") ``` ### Technical Analysis The feed-fetching implementation explicitly disables both TLS certificate verification and hostname checking. Consequently, the client does not verify that an HTTPS response was produced by the legitimate server identified by the configured URL. Disabling these protections is not necessary for the declared RSS aggregation functionality. The default Python TLS context already validates trusted certificate chains and hostnames. The comment indicating that this behavior is “for testing” does not reduce the risk because the insecure context is used unconditionally in the production execution path. An attacker capable of intercepting or modifying network traffic can impersonate any configured HTTPS feed source. The attacker can then supply a forged RSS or Atom document containing fabricated headlines, attacker-controlled links, or content designed to exploit weaknesses in feed generation and downstream RSS clients. ### Attack Path 1. A user runs `aggregate_feeds.py` on an untrusted or compromised network. 2. The script initiates an HTTPS request to a configured feed. 3. A network-positioned attacker intercepts the connection and presents an arbitrary certificate. 4. The script accepts the certificate because certificate and hostname verification are disabled. 5. The attacker returns a forged RSS or Atom response. 6. The forged ...[truncated 607 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the custom TLS settings that disable validation. - Use the default verified TLS behavior: ```python req = urllib.request.Request( url, headers={"User-Agent": USER_AGENT}, ) with urllib.request.urlopen(req, timeout=30) as response: content = response.read().decode("utf-8") ``` - If a private certificate authority is legitimately required, load only that specific trusted CA rather than disabling all verification. - Fail closed on certificate or hostname validation errors. - Add automated tests confirming that expired, self-signed, and hostname-mismatched certificates are rejected. - Log validation failures without retrying through an insecure fallback. ]]>