T09 · Insecure Skill Coding Practices
Warning
- Location
- src/utils/api-client.js:68
- Finding
- Direct-IP Mode Disables TLS Certificate Verification<![CDATA[ ## Vulnerability Details **File Location**: `src/utils/api-client.js:68-89` **Vulnerability Type**: Improper certificate validation **Risk Level**: Medium ```javascript // IP direct mode: replace URL and set Host header if (this.useIpDirect && this.ipBaseUrl && options.url) { // Replace baseUrl with IP direct address const originalUrl = new URL(options.url); const ipUrl = new URL(this.ipBaseUrl); // Keep original path and query params, only replace protocol and host const newUrl = `${this.ipBaseUrl}${originalUrl.pathname}${originalUrl.search}`; requestConfig.url = newUrl; // Set Host header (SNI) if (this.hostHeader) { requestConfig.headers['Host'] = this.hostHeader; } // For HTTPS IP direct, need to disable certificate verification (certificate is for domain) if (ipUrl.protocol === 'https:') { requestConfig.httpsAgent = new https.Agent({ rejectUnauthorized: false }); } } ``` ### Technical Analysis When direct-IP mode is enabled, the HTTP client creates an HTTPS agent with `rejectUnauthorized: false`. This disables certificate-chain and endpoint-identity validation, allowing any certificate to be accepted. The constructor also reads a `rejectUnauthorized` configuration value, but this value is not used when creating the HTTPS agent. Consequently, the direct-IP branch disables verification unconditionally. Direct-IP routing is not enabled by the supplied default configuration, so exploitation requires an operator or deployment configuration to enable `useIpDirect` and set `ipBaseUrl`. Once enabled, network traffic no longer receives normal TLS authentication. ### Attack Path 1. An operator enables `useIpDirect` and configures an HTTPS `ipBaseUrl`. 2. The Skill redirects API requests from the intended DefiLlama hostname to the configured IP address. 3. An attacker with a network interception position redirects or intercepts the connection. 4. The attacker presents an arbitrary, self-signed, expired, o ...[truncated 743 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the direct-IP TLS bypass and never set `rejectUnauthorized: false`. - Connect using the expected hostname so Node.js can perform normal certificate and hostname validation. - If direct-IP routing is operationally necessary, preserve the original hostname for SNI and explicitly verify the certificate against that hostname. - Use a properly configured DNS override or custom `lookup` function rather than replacing the URL hostname and disabling TLS checks. - Remove the unused `rejectUnauthorized` configuration option or enforce a secure value of `true`. - Add an automated test verifying that self-signed, expired, and hostname-mismatched certificates are rejected in every connection mode. ]]>