T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:48- Finding
Authenticated Service Communications Are Configured Without Transport Encryption
- Content
View full analysis
' ``` ### Technical Analysis The documented gRPC configuration explicitly selects plaintext negotiation, while the REST examples use `http://` URLs. Elsewhere, the guide directs clients to transmit `X-TENANT`, `X-UID`, and OIDC bearer-token headers through these service channels. Plaintext communication does not provide transport confidentiality, endpoint authentication, or message integrity. An attacker who can observe or manipulate the relevant network path could read authentication material and tenant context, modify requests or responses, or replay captured credentials. Although the examples use an internal service hostname, an internal network boundary alone does not provide equivalent protection to TLS. Compromised workloads, malicious insiders, incorrectly exposed network interfaces, or weaknesses in cluster network isolation could provide the required network position. ### Attack Path 1. An application is deployed using the documented plaintext gRPC configuration or HTTP examples. 2. The application sends tenant identifiers, user identifiers, bearer tokens, configuration values, or service responses across the network. 3. An attacker gains visibility into the internal network path, such as through a compromised workload, network misconfiguration, or packet-capture capability. 4. The attacker captures an OIDC bearer token or modifies a management request in transi ...[truncated 992 chars]- Remediation
View remediation