T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pikvm_api.py:29- Finding
PiKVM Credentials May Leak Through Cross-Origin Redirects
- Content
View full analysis
requests.Response: url = f"{self.base_url}{path}" response = self.session.request( method=method, url=url, params=params, data=data, headers=headers, timeout=self.timeout, verify=self.verify_ssl, stream=stream, ) ``` ### Technical Analysis The client stores the PiKVM username and password in custom session headers and uses `requests.Session.request()` without disabling redirects. The Requests library follows redirects by default. Standard `Authorization` credentials receive special redirect handling, but the custom `X-KVMD-User` and `X-KVMD-Passwd` headers are not guaranteed to be removed when a redirect changes origin. Consequently, a malicious or compromised PiKVM server can redirect an authenticated request to another host and potentially cause the client to forward these custom credential headers. The password may also contain a time-based one-time password because the documentation instructs users to append the current TOTP value directly to the password. ### Attack Path 1. An attacker compromises the configured PiKVM endpoint, controls a substituted endpoint, or otherwise causes the client to connect to a malicious server. 2. The user invokes any supported API operation. 3. The initial server returns an HTTP redirect to an attacker-con ...[truncated 736 chars]- Remediation
View remediation