T09 · Insecure Skill Coding Practices
- Location
scripts/check_apis.py:23- Finding
TLS Certificate and Hostname Verification Disabled
- Content
View full analysis
Vulnerability Details
File Location:
scripts/check_apis.py, lines 23–25
Vulnerability Type: Improper TLS certificate validation
Risk Level: MediumVulnerable Code:
python ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONETechnical Analysis
The script creates a default TLS context but then explicitly disables hostname verification and certificate-chain validation. Consequently, HTTPS connections remain encrypted but do not authenticate the remote API server.
An attacker capable of intercepting network traffic can present an arbitrary certificate and impersonate any configured API endpoint. Because the health-check result is derived from the resulting HTTP response, the attacker can return fabricated status codes and cause the script to report false service availability.
Attack Path
- An attacker obtains a network interception position, such as control of a malicious access point, compromised proxy, DNS path, or local network gateway.
- The script sends an HTTPS
HEADrequest to a configured API endpoint. - The attacker intercepts the connection and presents an untrusted certificate.
- The script accepts the certificate because both certificate and hostname verification are disabled.
- The attacker returns a fabricated HTTP response.
- The script interprets the attacker-controlled status code and reports a false API health result.
Impact Assessment
Exploitation does not directly grant local system privileges, code execution, or access to credentials because the requests contain only a fixed user-agent header and no authentication data. However, an on-path attacker can compromise the integrity and authenticity of all health-check results, impersonate every configured service, and manipulate operational troubleshooting decisions. The scope is limited to this script's outbound API checks and their reported results.
- Remediation
View remediation
Remediation Suggestions
Retain Python's secure default TLS behavior by removing the lines that disable hostname and certificate verification:
python ctx = ssl.create_default_context()Continue passing this verified context to
urllib.request.urlopen. If the runtime requires a custom certificate authority, load only the explicitly trusted CA bundle withctx.load_verify_locations()rather than usingssl.CERT_NONE. Treat certificate-validation failures as failed health checks and include a concise TLS error in the output without retrying through an insecure context.