T09 · Insecure Skill Coding Practices
- Location
src/client.js:52- Finding
Bearer Credentials and Account Data Transmitted over Plaintext HTTP by Default
- Content
View full analysis
Vulnerability Details
File Location:
src/config.js:14,src/client.js:52-66
Vulnerability Type: Plaintext transmission of authentication credentials and sensitive account data
Risk Level: HighComplete Code Snippet
src/config.js:14:js const DEFAULT_BASE_URL = 'http://st.aidata366.com';src/client.js:52-66:js // 明文 http + 携带 token 时提示一次 (每进程仅一次), 不打断请求 if (!_httpWarned && this.token && this.baseUrl.startsWith('http://')) { _httpWarned = true; process.stderr.write('[warn] 当前服务地址为明文 http，token 会明文传输，建议确认网络安全或切换 https\n'); } const ctrl = new AbortController(); const timer = setTimeout(() => ctrl.abort(), REQUEST_TIMEOUT_MS); let res; let payload = null; try { res = await fetch(this.baseUrl + '/api/v1' + apiPath, { method, headers: { ...(body ? { 'Content-Type': 'application/json' } : {}), ...(this.token ? { Authorization: `Bearer ${this.token}` } : {}), ...headers, },Technical Analysis
The built-in service endpoint uses plaintext HTTP. The API client then attaches the user's bearer token to the
Authorizationheader for authenticated requests to that endpoint. The implementation recognizes this exposure but only prints a warning and proceeds with the request.The same plaintext channel is also used for CLI authentication-session creation and checking. Consequently, authentication-session values and the bearer token returned by a successful session check can cross the network without confidentiality or authenticated transport. Authenticated API responses and submitted task data are similarly exposed to interception or modification.
This is a reachable default execution path rather than an optional misconfiguration: absent a command-line, environment, or saved configuration override,
resolveConfig()selects the HTTP endpoint.Attack Path
- A user invokes the Skill using its default configuration and registers, logs in, checks quota, submits a conversion task, queries ...[truncated 1620 chars]
- Remediation
View remediation
Remediation Suggestions
- Change the production default endpoint to an HTTPS URL with a valid certificate.
- Reject non-HTTPS service URLs whenever authentication-session material or bearer credentials would be transmitted.
- If local development support is required, restrict plaintext HTTP to explicit loopback destinations such as
127.0.0.1orlocalhost, and require an explicit development-only opt-in. - Replace the warning-only check with a fail-closed validation before creating any authentication session or authenticated request.
- Keep TLS certificate verification enabled. Remove or tightly constrain the process-wide
NODE_TLS_REJECT_UNAUTHORIZED=0mode because it defeats server authentication for HTTPS connections in the process. - Revoke and rotate tokens that may already have traversed plaintext networks after deploying HTTPS enforcement.
- Add automated tests confirming that HTTP production endpoints are rejected and that bearer headers are only attached to verified HTTPS destinations.