T09 · Insecure Skill Coding Practices
- Location
scripts/ebook-db.py:34- Finding
Disabled TLS Certificate and Hostname Verification
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ebook-db.py, lines 34–36
Vulnerability Type: Improper certificate validation (CWE-295)
Risk Level: HighVulnerable Code
python ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONEThis context is subsequently used for the database request:
python with urllib.request.urlopen(req, context=ctx, timeout=120) as resp: data = resp.read()Technical Analysis
The script creates a standard TLS context but then explicitly disables both hostname checking and certificate verification. Although
DATABASE_URLuses HTTPS, these settings remove server authentication. Consequently, the client will accept an invalid, self-signed, expired, or attacker-controlled certificate.The downloaded JSON is written directly to
~/.cache/ebook-search/all-books.jsonand treated as trusted catalog data. Its externally controlled fields—including titles, authors, categories, formats, and download links—are later displayed to users. No signature, trusted digest, schema validation, or download-link domain allowlist provides a secondary integrity control.This does not directly execute remote code. It enables catalog and link substitution through a man-in-the-middle attack.
Attack Path
- The victim invokes a command that refreshes the catalog, such as
update, or runs another command after the cache expires. - An attacker with a network interception capability redirects or intercepts the connection to the configured database host.
- The attacker presents an arbitrary TLS certificate.
- Because certificate and hostname verification are disabled, the script accepts the attacker’s endpoint.
- The attacker returns a modified JSON catalog containing attacker-selected metadata and download URLs.
- The script saves that response in the local cache.
- Subsequent searches display the attacker-controlled links as ebook download links.
- A user who follows ...[truncated 750 chars]
- The victim invokes a command that refreshes the catalog, such as
- Remediation
View remediation
Remediation Suggestions
Use Python’s default verified TLS behavior and do not disable certificate or hostname validation:
python ctx = ssl.create_default_context() with urllib.request.urlopen(req, context=ctx, timeout=120) as resp: data = resp.read()Alternatively, omit the explicit context so that
urllibuses the platform’s trusted certificate configuration:python with urllib.request.urlopen(req, timeout=120) as resp: data = resp.read()Apply the following defense-in-depth controls:
- Ensure the runtime has an up-to-date CA trust store; fix certificate deployment problems rather than bypassing validation.
- Validate the response content type, maximum size, JSON structure, and expected field types before replacing the cache.
- Restrict displayed download links to explicitly trusted HTTPS hosts if the catalog is expected to reference a defined set of providers.
- If the publisher can provide one, verify a cryptographic signature or a securely distributed digest for the catalog.
- Parse and validate the downloaded data before atomically replacing the last known-good cache.
- Add an automated test confirming that connections using invalid certificates or mismatched hostnames are rejected.