T09 · Insecure Skill Coding Practices
- Location
aggregate_feeds.py:58- Finding
TLS certificate validation is explicitly disabled for remote feed retrieval
- Content
View full analysis
Vulnerability Details
File Location:
aggregate_feeds.py, lines 58-69
Vulnerability Type: Improper certificate validation (CWE-295)
Risk Level: HighVulnerable Code
python try: # Create SSL context that doesn't verify certificates (for testing) ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE req = urllib.request.Request( url, headers={"User-Agent": USER_AGENT} ) with urllib.request.urlopen(req, timeout=30, context=ctx) as response: content = response.read().decode("utf-8")Technical Analysis
The aggregator deliberately disables both TLS certificate validation and hostname verification for every configured HTTPS feed. Consequently, HTTPS provides encryption without authenticating the remote server.
Any party capable of intercepting network traffic can present an arbitrary certificate and impersonate a configured news provider. The resulting attacker-controlled response is parsed as RSS or Atom and incorporated into
combined_danish_news.xml.Disabling verification globally is unnecessary for the Skill's declared RSS aggregation functionality. Python's default SSL context already validates certificates using the host trust store.
Attack Path
- A victim runs
aggregate_feeds.pyon an untrusted or compromised network. - An attacker intercepts a request to a configured HTTPS RSS endpoint through a malicious access point, DNS manipulation, proxy compromise, or upstream routing attack.
- The attacker presents any TLS certificate.
- Because hostname and certificate verification are disabled, the client accepts the certificate.
- The attacker returns a crafted RSS or Atom document containing false headlines, attacker-controlled links, or oversized content.
- The content is incorporated into the generated RSS file and subsequently delivered to consumers.
...[truncated 426 chars]
- A victim runs
- Remediation
View remediation
Remediation Suggestions
-
Remove the custom verification-disabling settings and use the default verified context:
python ctx = ssl.create_default_context() with urllib.request.urlopen(req, timeout=30, context=ctx) as response: content = response.read(MAX_RESPONSE_BYTES + 1) -
Reject content exceeding a defined response-size limit.
-
Validate the response
Content-Typeand final URL after redirects. -
Permit only HTTPS URLs from an explicit hostname allowlist.
-
If a specific provider requires a private CA, install or configure that CA explicitly rather than disabling validation globally.
-
Record certificate and parsing failures without falling back to insecure transport.
-