T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/eleme_api.py:14
- Finding
- TLS Certificate and Hostname Verification Disabled<![CDATA[ ## Vulnerability Details **File Location**: `scripts/eleme_api.py:14-18`, with the insecure context used at `scripts/eleme_api.py:61-62` and `scripts/eleme_api.py:93-94` **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code ```python def create_ssl_context(): """创建SSL上下文""" ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE return ctx ``` The resulting context is used for requests containing the authentication cookie: ```python ctx = create_ssl_context() with urllib.request.urlopen(req, timeout=10, context=ctx) as response: data = json.loads(response.read()) return data ``` ### Technical Analysis The custom SSL context explicitly disables both certificate-chain validation and hostname verification. Although the requests use HTTPS, the client does not authenticate that the remote endpoint is genuinely `www.ele.me`. Both `get_nearby_restaurants()` and `get_restaurant_foods()` attach the user's Ele.me cookie to requests made through this context. The nearby-restaurant request also includes the user's latitude and longitude in the URL. Consequently, an attacker capable of intercepting network traffic can present an arbitrary certificate without causing the connection to fail. ### Attack Path 1. The user invokes the `recommend` command while connected through an attacker-controlled or compromised network. 2. The attacker intercepts DNS or network traffic intended for `www.ele.me`. 3. The attacker presents an untrusted certificate for an impersonated endpoint. 4. Because certificate and hostname verification are disabled, the client accepts the endpoint. 5. The client sends the Ele.me session cookie and, for the restaurant request, the user's coordinates to the attacker. 6. The attacker may replay the cookie against Ele.me within the permissions and lifetime of that session. 7. The attacker may also return manipulated API responses, caus ...[truncated 601 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the custom context and allow `urllib.request.urlopen()` to use the platform's verified default TLS configuration: ```python with urllib.request.urlopen(req, timeout=10) as response: data = json.loads(response.read()) ``` - Alternatively, use an explicitly verified context without modifying its security properties: ```python ctx = ssl.create_default_context() with urllib.request.urlopen(req, timeout=10, context=ctx) as response: data = json.loads(response.read()) ``` - Never set `check_hostname` to `False` or `verify_mode` to `ssl.CERT_NONE` for authenticated requests. - Fail closed when certificate validation fails. Do not retry over an unverified connection. - Avoid returning raw transport exception details to users or logs if those details may expose sensitive request information. - Invalidate and replace cookies that may previously have been transmitted over untrusted networks while this implementation was in use. ]]>