T09 · Insecure Skill Coding Practices
Error
- Location
- salute_transcribe.py:29
- Finding
- TLS Certificate Verification Disabled for Sensitive API Traffic<![CDATA[ ## Vulnerability Details **File Location**: `salute_transcribe.py:29-35, 89-91, 140-145, 219-224, 265-270, 346-351`; documented in `SKILL.md:16` **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code ```python def __init__( self, auth_data: str | tuple[str, str], scope: str = "SALUTE_SPEECH_PERS", verify_ssl=False ): ``` The insecure setting is passed to all API operations, including authentication and audio upload: ```python response = requests.post( self.oauth_url, headers=headers, data=data, verify=self.verify_ssl ) ``` ```python with open(audio_file_path, "rb") as audio_file: response = requests.post( self.upload_url, headers=headers, data=audio_file, verify=self.verify_ssl, ) ``` It is also used for recognition-task creation, status polling, and result download: ```python response = requests.post( self.recognize_url, headers=headers, json=payload, verify=self.verify_ssl, ) ``` ```python response = requests.get( self.task_status_url, headers=headers, params=params, verify=self.verify_ssl, ) ``` ```python response = requests.get( self.download_url, headers=headers, params=params, verify=self.verify_ssl, ) ``` ### Technical Analysis The client defaults `verify_ssl` to `False`, disabling server certificate and hostname validation for every HTTPS request. The script additionally suppresses the resulting `InsecureRequestWarning`. Encryption without peer authentication does not protect against an active man-in-the-middle attacker. A forged certificate will be accepted, allowing an attacker in a privileged network position to impersonate the configured Sber endpoints. The affected traffic includes: - The Base64-encoded Basic authorization credential used to request an access token - The resulting bearer access token - User-selected audio or video content - Recognition configuration and task ide ...[truncated 2184 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Enable certificate verification by default: ```python def __init__( self, auth_data: str | tuple[str, str], scope: str = "SALUTE_SPEECH_PERS", verify_ssl: bool | str = True, ): ``` 2. If the provider requires a nonstandard certificate authority, obtain the official CA certificate through a trusted channel and pass its local path to Requests: ```python client = SaluteSpeechClient( auth_data=AUTH_DATA, verify_ssl="/path/to/trusted-sber-ca-bundle.pem", ) ``` 3. Do not suppress `InsecureRequestWarning` globally. Certificate failures should stop execution and produce a clear error. 4. Do not offer an insecure mode as the default. If an emergency override is retained, require an explicit command-line option with a prominent warning and avoid its use in automated workflows. 5. Validate that all configured service URLs use HTTPS and remain restricted to the documented provider hosts. 6. Rotate `SALUTE_AUTH_DATA` if the script has previously been used over an untrusted network while certificate verification was disabled. 7. Update `SKILL.md` to document installation of the trusted CA bundle instead of recommending disabled verification. ]]>