T09 · Insecure Skill Coding Practices
- Location
src/config.js:20- Finding
Bearer Token Transmitted over Plaintext HTTP by Default
- Content
View full analysis
Vulnerability Details
File Location:
src/config.js:20,src/client.js:50-70
Vulnerability Type: Plaintext transmission of authentication credentials
Risk Level: HighVulnerable Code
src/config.js:20:js const DEFAULT_BASE_URL = 'http://st.aidata366.com';src/client.js:50-70:js async request(method, apiPath, opts = {}) { const { body, headers = {}, timeoutMs = REQUEST_TIMEOUT_MS } = opts; // Plain HTTP with a token only produces a warning and does not stop the request. if (!_httpWarned && this.token && this.baseUrl.startsWith('http://')) { _httpWarned = true; process.stderr.write('[warn] Current service address uses plaintext HTTP; token will be transmitted in plaintext\n'); } const ctrl = new AbortController(); const timer = setTimeout(() => ctrl.abort(), timeoutMs); let res; let payload = null; try { res = await fetch(this.baseUrl + '/api/v1' + apiPath, { method, headers: { ...(body ? { 'Content-Type': 'application/json' } : {}), ...(this.token ? { Authorization: `Bearer ${this.token}` } : {}), ...headers, }, body: body ? JSON.stringify(body) : undefined, signal: ctrl.signal, });Technical Analysis
The built-in service endpoint uses unencrypted HTTP. Authenticated API requests place the locally stored bearer token in the
Authorizationheader and send it to that endpoint without transport encryption or authenticated TLS.The implementation recognizes this condition but only writes a warning to stderr. It neither blocks the request nor requires explicit approval. Consequently, the default authenticated workflow exposes the token to every network segment between the client and the service.
The affected commands include
quota,submit,query,export, andlogout. The direct export download incli.js:320-321also sends the sa ...[truncated 1129 chars]- Remediation
View remediation
Remediation Suggestions
- Replace the default endpoint with an HTTPS URL backed by a valid certificate.
- Reject authenticated requests to non-HTTPS destinations rather than merely printing a warning.
- If HTTP is required for local development, restrict it to loopback addresses such as
127.0.0.1andlocalhost. - Require an explicit, narrowly scoped opt-in before allowing credentials over HTTP.
- Apply the same transport validation to direct export downloads and all other code paths that attach authorization headers.
- Avoid disabling TLS certificate validation process-wide. If self-signed certificates must be supported, use a dedicated certificate authority or per-client trust configuration.
- Revoke or rotate tokens that may previously have traversed the plaintext endpoint.