T09 · Insecure Skill Coding Practices
- Location
SKILL.md:23- Finding
DSM Credentials and Session Identifiers Exposed Through Plaintext HTTP URLs
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 23-37 and 50-256
Vulnerability Type: Plaintext transmission and URL exposure of authentication secrets
Risk Level: HighThe skill recommends HTTPS in prose, but its base URL and every executable DSM API example use
http://. The login request places the DSM username and password directly in the query string, while subsequent requests place the session identifier (SID) in their URLs.Vulnerable code:
markdown Base URL: `http://$SYNOLOGY_HOST:$SYNOLOGY_PORT/webapi` > **Security**: Always prefer HTTPS (port 5001). Never hardcode credentials in commands shown to the user — use `$SYNOLOGY_PASS` references. If the user hasn't set env vars, ask them to provide connection details.bash curl -s "http://$SYNOLOGY_HOST:$SYNOLOGY_PORT/webapi/entry.cgi?\ api=SYNO.API.Auth&version=6&method=login\ &account=$SYNOLOGY_USER&passwd=$SYNOLOGY_PASS\ &session=FileStation&format=sid" | jq .bash curl -s "http://$SYNOLOGY_HOST:$SYNOLOGY_PORT/webapi/entry.cgi?\ api=SYNO.API.Auth&version=6&method=logout\ &session=FileStation&_sid=$SID"The same insecure URL pattern is used throughout the FileStation, DownloadStation, and system-information examples through line 256:
bash curl -s "http://$SYNOLOGY_HOST:$SYNOLOGY_PORT/webapi/entry.cgi?\ api=SYNO.FileStation.Delete&version=2&method=delete\ &path=/volume1/homes/unwanted_file&_sid=$SID" | jq .Technical Analysis
HTTP provides no transport confidentiality or server authentication. An attacker with visibility into the network path—such as a compromised router, malicious wireless access point, hostile local-network participant, or upstream proxy—can inspect or modify these requests.
Referencing secrets through environment variables does not prevent disclosure here. The shell expands
$SYNOLOGY_USER,$SYNOLOGY_PASS, and$SIDbefore invokingcurl, so their values b ...[truncated 2030 chars]- Remediation
View remediation
Remediation Suggestions
-
Require HTTPS rather than merely recommending it.
- Define the base URL with
https://. - Refuse to transmit credentials when the configured endpoint is HTTP.
- Make the protocol explicit through a validated variable if legacy deployments must be supported.
bash SYNOLOGY_BASE_URL="https://$SYNOLOGY_HOST:${SYNOLOGY_PORT:-5001}/webapi" - Define the base URL with
-
Move login credentials out of the URL.
- Use an HTTPS POST request with form fields.
- Use
--data-urlencodeso special characters in usernames, passwords, session names, and OTP values cannot alter parameter boundaries.
bash curl --silent --show-error --fail-with-body \ --request POST \ --data-urlencode "api=SYNO.API.Auth" \ --data-urlencode "version=6" \ --data-urlencode "method=login" \ --data-urlencode "account=$SYNOLOGY_USER" \ --data-urlencode "passwd=$SYNOLOGY_PASS" \ --data-urlencode "session=FileStation" \ --data-urlencode "format=sid" \ "$SYNOLOGY_BASE_URL/entry.cgi" -
Avoid session identifiers in query strings.
- Prefer DSM's secure session-cookie mechanism where supported.
- Otherwise, send the SID in an HTTPS POST body rather than in the URL.
- Ensure diagnostic output, command tracing, and logs do not contain the SID.
-
Enforce certificate verification.
- Retain
curl's default TLS certificate and hostname verification. - Do not recommend
curl -kor--insecure. - For a private DSM certificate authority, configure a trusted CA using
--cacertor the host trust store.
- Retain
-
Reduce compromise impact.
- Use a dedicated, least-privileged DSM service account.
- Grant access only to required shares and APIs.
- Avoid administrator accounts for routine FileStation or DownloadStation operations.
- Unset password and SID variables after logout and ensure logout runs even when an ...[truncated 266 chars]
-