T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/get_jiraData.py:121
- Finding
- TLS Certificate Verification Can Be Disabled for Authenticated Jira Requests<![CDATA[ ## Vulnerability Details **File Location**: `scripts/get_jiraData.py:81, 121-130, 155-159`; related instructions in `SKILL.md:32, 52-63, 72, 81` **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Complete Code Snippet ```python parser.add_argument( "--no-verify", action="store_true", help="Disable SSL certificate verification" ) ``` ```python def build_session(args): """Create and configure an HTTP session.""" session = requests.Session() if args.token: session.headers["Authorization"] = f"Bearer {args.token}" else: session.auth = (args.username, args.password) session.headers["Content-Type"] = "application/json" session.verify = not args.no_verify if args.no_verify: urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) return session ``` ```python try: resp = session.post(url, json=payload, timeout=30) except requests.exceptions.SSLError as e: log(f"ERROR: SSL certificate verification failed: {e}") log("Hint: Use --no-verify for self-signed certificates.") sys.exit(1) ``` The documentation also recommends an equivalent unsafe option: ```bash curl -u <USER>:<PASS> -k <SERVER>/rest/api/2/project/<PROJECT_KEY> | python3 -c "import sys,json;[print(t['name']) for t in json.load(sys.stdin).get('issueTypes',[])]" ``` ### Technical Analysis When `--no-verify` is supplied, `requests` no longer authenticates the Jira server's TLS certificate. The documented `curl -k` command has the same effect. Disabling warning messages further reduces the likelihood that the user will notice the connection is unauthenticated. The session sends either a bearer token or Basic Authentication credentials over this connection. TLS encryption without certificate validation does not establish the identity of the remote server, so an active network attacker can present an arbitrary certificate and impersonate Jira. Supporting private certificate a ...[truncated 1672 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `--no-verify` and the documented `curl -k` workflow. 2. Add a `--ca-bundle PATH` option and pass the supplied private CA bundle to `session.verify`. 3. Require HTTPS for authenticated requests and reject `http://` Jira URLs. 4. Preserve certificate warnings rather than suppressing them. 5. If an emergency bypass must remain, require an explicit interactive confirmation, display a prominent credential-exposure warning, and prevent unattended use. 6. Recommend a least-privileged, read-only Jira service account whose access is restricted to the requested project. ]]>