T09 · Insecure Skill Coding Practices
- Location
src/config.js:19- Finding
Bearer Authentication Tokens Are Transmitted over Plaintext HTTP by Default
- Content
View full analysis
Vulnerability Details
File Location:
src/config.js:19,src/client.js:52-71,cli.js:319-320
Vulnerability Type: Plaintext transmission of authentication credentials
Risk Level: HighTechnical Analysis
The built-in service endpoint uses plaintext HTTP:
js const DEFAULT_BASE_URL = 'http://st.aidata366.com';The API client attaches the account bearer token to requests made to this endpoint:
js res = await fetch(this.baseUrl + '/api/v1' + apiPath, { method, headers: { ...(body ? { 'Content-Type': 'application/json' } : {}), ...(this.token ? { Authorization: `Bearer ${this.token}` } : {}), ...headers, }, body: body ? JSON.stringify(body) : undefined, signal: ctrl.signal, });Export downloads transmit the same token through the configured URL:
js const res = await fetch(url, { headers: { Authorization: `Bearer ${cfg.token}` }, signal: dlCtrl.signal });Unless the user explicitly changes the endpoint, authenticated commands therefore send reusable bearer credentials over an unencrypted and unauthenticated network channel. The warning emitted by the client does not prevent the request or protect its contents.
The affected operations include account profile and quota queries, collection task submission, task result access, session operations, logout, and export downloads.
Attack Path
- The user registers or logs in, causing an API bearer token to be stored locally.
- The user or agent invokes an authenticated command without overriding the default base URL.
- The client connects to
http://st.aidata366.comand includesAuthorization: Bearer <token>. - A network-positioned attacker observes or intercepts the plaintext HTTP request.
- The attacker extracts and reuses the bearer token against API operations authorized for that token.
- Alternatively, an active attacker modifies API responses or downloaded CSV data because HTTP provides neither transport confidentiality nor server au ...[truncated 654 chars]
- Remediation
View remediation
Remediation Suggestions
- Configure a valid TLS certificate and change the default endpoint to HTTPS.
- Reject authenticated requests to non-HTTPS remote endpoints rather than merely printing a warning.
- If plaintext HTTP is required for local development, restrict it to loopback destinations such as
127.0.0.1andlocalhost. - Require an explicit, narrowly scoped opt-in before permitting credentials over any other HTTP endpoint.
- Disable redirects that could forward authorization headers to an unintended origin, or validate every redirect destination before retaining credentials.
- Revoke or rotate tokens that may previously have been transmitted over untrusted plaintext networks.