T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:23
- Finding
- DSM Credentials and Session Identifiers Exposed Through Plaintext HTTP URLs## Vulnerability Details **File Location**: `SKILL.md`, lines 23-37 and 50-256 **Vulnerability Type**: Plaintext transmission and URL exposure of authentication secrets **Risk Level**: High The skill recommends HTTPS in prose, but its base URL and every executable DSM API example use `http://`. The login request places the DSM username and password directly in the query string, while subsequent requests place the session identifier (`SID`) in their URLs. **Vulnerable code:** ```markdown Base URL: `http://$SYNOLOGY_HOST:$SYNOLOGY_PORT/webapi` > **Security**: Always prefer HTTPS (port 5001). Never hardcode credentials in commands shown to the user — use `$SYNOLOGY_PASS` references. If the user hasn't set env vars, ask them to provide connection details. ``` ```bash curl -s "http://$SYNOLOGY_HOST:$SYNOLOGY_PORT/webapi/entry.cgi?\ api=SYNO.API.Auth&version=6&method=login\ &account=$SYNOLOGY_USER&passwd=$SYNOLOGY_PASS\ &session=FileStation&format=sid" | jq . ``` ```bash curl -s "http://$SYNOLOGY_HOST:$SYNOLOGY_PORT/webapi/entry.cgi?\ api=SYNO.API.Auth&version=6&method=logout\ &session=FileStation&_sid=$SID" ``` The same insecure URL pattern is used throughout the FileStation, DownloadStation, and system-information examples through line 256: ```bash curl -s "http://$SYNOLOGY_HOST:$SYNOLOGY_PORT/webapi/entry.cgi?\ api=SYNO.FileStation.Delete&version=2&method=delete\ &path=/volume1/homes/unwanted_file&_sid=$SID" | jq . ``` ### Technical Analysis HTTP provides no transport confidentiality or server authentication. An attacker with visibility into the network path—such as a compromised router, malicious wireless access point, hostile local-network participant, or upstream proxy—can inspect or modify these requests. Referencing secrets through environment variables does not prevent disclosure here. The shell expands `$SYNOLOGY_USER`, `$SYNOLOGY_PASS`, and `$SID` before invoking `curl`, so their values b ...[truncated 2030 chars]
- Remediation
- ## Remediation Suggestions 1. **Require HTTPS rather than merely recommending it.** - Define the base URL with `https://`. - Refuse to transmit credentials when the configured endpoint is HTTP. - Make the protocol explicit through a validated variable if legacy deployments must be supported. ```bash SYNOLOGY_BASE_URL="https://$SYNOLOGY_HOST:${SYNOLOGY_PORT:-5001}/webapi" ``` 2. **Move login credentials out of the URL.** - Use an HTTPS POST request with form fields. - Use `--data-urlencode` so special characters in usernames, passwords, session names, and OTP values cannot alter parameter boundaries. ```bash curl --silent --show-error --fail-with-body \ --request POST \ --data-urlencode "api=SYNO.API.Auth" \ --data-urlencode "version=6" \ --data-urlencode "method=login" \ --data-urlencode "account=$SYNOLOGY_USER" \ --data-urlencode "passwd=$SYNOLOGY_PASS" \ --data-urlencode "session=FileStation" \ --data-urlencode "format=sid" \ "$SYNOLOGY_BASE_URL/entry.cgi" ``` 3. **Avoid session identifiers in query strings.** - Prefer DSM's secure session-cookie mechanism where supported. - Otherwise, send the SID in an HTTPS POST body rather than in the URL. - Ensure diagnostic output, command tracing, and logs do not contain the SID. 4. **Enforce certificate verification.** - Retain `curl`'s default TLS certificate and hostname verification. - Do not recommend `curl -k` or `--insecure`. - For a private DSM certificate authority, configure a trusted CA using `--cacert` or the host trust store. 5. **Reduce compromise impact.** - Use a dedicated, least-privileged DSM service account. - Grant access only to required shares and APIs. - Avoid administrator accounts for routine FileStation or DownloadStation operations. - Unset password and SID variables after logout and ensure logout runs even when an ...[truncated 266 chars]