T09 · Insecure Skill Coding Practices
Error
- Location
src/api.js:6- Finding
SonarQube Authentication Token Can Be Transmitted over Plaintext HTTP
- Content
View full analysis
} API response */ async function fetchFromSonarQube(endpoint, params = {}) { const url = new URL(`${SONAR_HOST}/api${endpoint}`); Object.entries(params).forEach(([key, value]) => { if (value !== undefined && value !== null) { url.searchParams.append(key, value); } }); const headers = {}; // Only add auth if token is provided and not default if (SONAR_TOKEN && SONAR_TOKEN !== 'admin') { headers['Authorization'] = `Basic ${Buffer.from(`${SONAR_TOKEN}:`).toString('base64')}`; } const response = await fetch(url.toString(), { headers }); ``` ### Technical Analysis The API client accepts any URL supplied through `SONAR_HOST_URL`, including remote URLs using unencrypted HTTP. When a non-default token is configured, the token is placed in an HTTP Basic Authorization header. Basic authentication only Base64-encodes the credential; it does not encrypt it. Consequently, when the destination uses HTTP, any party capable of observing or altering the network connection may recover the SonarQube token by decoding the header. The default loopback URL is reasonable for local SonarQube use. However, the implementation does not limit plaintext HTTP to loopback destinations and the documentation explicitly permits users to configure another server URL. This exceeds safe minimum network privileges because a sensitive credential can be sent over an unauthenticated, unencrypted channel. ### Attack Path 1. A user configures `SONA ...[truncated 1401 chars]- Remediation
View remediation