T09 · Insecure Skill Coding Practices
Error
- Location
scripts/librenms.sh:56- Finding
API Token Transmitted Without TLS Certificate Verification
- Content
View full analysis
&1) || { ``` The insecure behavior is also explicitly documented in `SKILL.md:67,115-117` and `README.md:172,185`. ### Technical Analysis The `-k` option instructs curl to accept a server certificate without verifying its trust chain or hostname. Because this option is enabled for every API request, the client cannot authenticate that it is communicating with the configured LibreNMS server. The request transmits the LibreNMS API token in the `X-Auth-Token` header. An attacker capable of intercepting or redirecting network traffic can present an arbitrary certificate, terminate the TLS connection, and recover the token. The attacker can also modify responses to provide false device status, alert, health, or port information. Using a self-signed certificate does not require globally disabling certificate verification. A private certificate authority or a pinned server certificate can be explicitly trusted instead. ### Attack Path 1. A user configures the Skill with a valid LibreNMS URL and API token. 2. The attacker obtains a network interception position, compromises DNS, controls a proxy, or otherwise redirects the connection. 3. The attacker presents an untrusted or hostname-mismatched TLS certificate. 4. Curl accepts that certificate because the command uses `-k`. 5. The Skill sends the `X-Auth-Token` header to the attacker-controlled endpoint. 6. The attacker captures and reuses the token against the genuine LibreNMS API, subject to the privileges assigned to the associated LibreNMS account. 7. The attacker may additionally return fabricated API data to conceal outages or generate misleading monitoring results. ### Impact A ...[truncated 748 chars]- Remediation
View remediation
&1) ``` 2. Add an optional configuration value for a private CA certificate and pass it through `--cacert`: ```bash curl_args=(-sS -w "\n%{http_code}") if [[ -n "${LIBRENMS_CA_CERT:-}" ]]; then curl_args+=(--cacert "$LIBRENMS_CA_CERT") fi response=$(curl "${curl_args[@]}" \ -H "X-Auth-Token: $API_TOKEN" \ -H "Accept: application/json" \ "$url" 2>&1) ``` 3. If an insecure mode must be retained for troubleshooting, make it an explicit opt-in setting such as `LIBRENMS_INSECURE_TLS=1`, emit a prominent warning, and prohibit its use by default. 4. Update `README.md` and `SKILL.md` to recommend installing a private CA or supplying a CA bundle rather than using `curl -k`. 5. Validate that `LIBRENMS_URL` uses the `https` scheme before sending the token. 6. Rotate any API token that has previously been used over an untrusted network with TLS verification disabled. 7. Assign the LibreNMS token the minimum server-side permissions required for monitoring. ]]>