T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/extract_news.js:30
- Finding
- TLS Certificate Verification Disabled for Authenticated API Requests## Vulnerability Details **File Location**: `scripts/extract_news.js`, lines 30-35 **Vulnerability Type**: Improper TLS certificate validation **Risk Level**: High ```js const options = { headers: { 'Authorization': API_KEY }, rejectUnauthorized: false // 跳过 SSL 证书验证，解决 "unable to verify the first certificate" 错误 }; ``` ### Technical Analysis The HTTPS request explicitly sets `rejectUnauthorized` to `false`. This disables verification of the server's certificate chain and identity, allowing the client to accept expired, self-signed, or attacker-controlled certificates. Because the request includes `EASYALPHA_API_KEY` in the `Authorization` header, an attacker capable of intercepting network traffic can impersonate the extraction server and obtain the credential. The attacker can also inspect submitted news URLs and modify the API response printed by the Skill. ### Attack Path 1. A user invokes the Skill with a news URL. 2. The script establishes an HTTPS connection to the configured extraction server. 3. An attacker with a network interception position presents a forged or otherwise untrusted certificate. 4. The Node.js client accepts that certificate because certificate verification is disabled. 5. The client sends the API key and target news URL to the attacker's endpoint. 6. The attacker captures the credential and may return manipulated extraction content. 7. The untrusted response is printed as if it originated from the legitimate service. ### Impact Assessment A successful attacker can obtain the extraction service API key, monitor which URLs are submitted, and manipulate extraction responses. The exposed privileges are limited to those granted by the API key, but manipulated output may also affect downstream Agent behavior if it is treated as trusted content.
- Remediation
- ## Remediation Suggestions - Remove `rejectUnauthorized: false` and rely on Node.js certificate verification. - Correct the server's certificate chain instead of bypassing validation. - If a private certificate authority is required, configure a narrowly scoped trusted CA through the `ca` option. - Avoid globally changing Node.js TLS verification settings. - Add an automated test confirming that invalid, expired, and hostname-mismatched certificates are rejected. - Rotate the API key if the vulnerable client has operated on an untrusted network.