T09 · Insecure Skill Coding Practices
- Location
scripts/cdp-trace.js:103- Finding
TLS Certificate Validation Disabled During Automated Credential Submission
- Content
View full analysis
Vulnerability Details
File Location:
scripts/cdp-trace.js, lines 45–46, 88–90, and 103–108
Vulnerability Type: Improper certificate validation leading to credential disclosure
Risk Level: MediumRelevant Code:
javascript else if (argv[i] === '--login') { args.login = takeValue('--login', i); i++; }javascript await fillAndSubmit(user, 'text'); await page.waitForTimeout(4000); await fillAndSubmit(pass, 'password');javascript const browser = await chromium.launch({ headless: false, slowMo: 800, args: ['--start-maximized'] }); const ctx = await browser.newContext({ ignoreHTTPSErrors: true, viewport: null }); const page = await ctx.newPage(); console.log(`[1] navigate ${args.url}`); await page.goto(args.url, { waitUntil: 'domcontentloaded', timeout: 30000 });Technical Analysis
The script accepts a target URL and optional credentials through
--urland--login. It creates a Playwright browser context withignoreHTTPSErrors: true, which suppresses TLS certificate validation failures for every destination.When
--loginis supplied, the script subsequently locates text/email and password fields in the loaded page and submits the supplied username and password. Therefore, credentials may be entered even when the HTTPS endpoint presents an expired, self-signed, hostname-mismatched, or otherwise untrusted certificate.This breaks the server-authentication guarantee expected from HTTPS. The browser continues to a page whose identity has not been cryptographically validated, and the automatic login routine treats that page as the intended service.
Attack Path
- The user invokes the script with an HTTPS target and the documented credential option:
bash node scripts/cdp-trace.js \ --url https://target.example/login \ --parts "app-group" \ --login user:password - A network-positioned attacker intercepts the connection, redirects traffic, or impersonates the ...[truncated 1011 chars]
- The user invokes the script with an HTTPS target and the documented credential option:
- Remediation
View remediation
Remediation Suggestions
-
Remove
ignoreHTTPSErrors: trueand use Playwright's secure default:javascript const ctx = await browser.newContext({ viewport: null }); -
If invalid certificates must be supported for explicitly authorized local development, add a clearly named opt-in flag such as
--allow-insecure-tls. Keep certificate validation enabled by default. -
Prohibit credential submission whenever insecure TLS mode is active:
javascript if (args.login && args.allowInsecureTls) { throw new Error( 'Credential submission is not allowed when TLS verification is disabled.' ); } -
Restrict any development-only exception to expected local targets rather than disabling validation globally. Validate the URL scheme and hostname before creating the browser context.
-
Prefer interactive user authentication or secure secret input over
--login user:pass, because command-line arguments may also expose credentials through shell history or process inspection. If programmatic login remains necessary, read the secret from a protected prompt, file descriptor, or secret manager. -
Add regression tests confirming that:
- invalid HTTPS certificates are rejected by default;
- insecure TLS requires explicit opt-in;
--logincannot be combined with insecure TLS mode; and- ordinary trusted HTTPS targets continue to work.
-