T09 · Insecure Skill Coding Practices
Error
- Location
- client.py:14
- Finding
- Credentials and Session Tokens May Be Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `client.py:14`, `client.py:32-36`, `client.py:68-75`; `SKILL.md:18-23` **Vulnerability Type**: Plaintext transmission of credentials and session tokens **Risk Level**: High ### Vulnerable Code `client.py:14`: ```python URL = os.environ.get("SYNOLOGY_URL", "http://{nas_ip}:5000") ``` `client.py:32-36`: ```python data = { "account": self.user, "passwd": self.password, "format": "sid" # 必须设为 "sid" } ``` `client.py:68-75`: ```python url = f"{self.url}{endpoint}" if "?" in url: url += f"&_sid={self.sid}" else: url += f"?_sid={self.sid}" # JSON body 中不需要包含 did/sid r = self.s.request(method, url, **kwargs) ``` `SKILL.md:18-23`: ```bash export SYNOLOGY_URL="http://{nas_ip}:5000" # 内网地址 export SYNOLOGY_USER="{username}" export SYNOLOGY_PASSWORD="your-password" ``` ### Technical Analysis The default configuration and documented example use unencrypted HTTP. The login method transmits the Synology username and password in a JSON request body. After authentication, `_request()` appends the SID authentication token to the request URL. When HTTP is used, transport-layer encryption and server authentication are absent. Any party able to observe or manipulate traffic between the client and NAS can read the account password, SID, request bodies, and returned calendar information. Placing the SID in the query string creates additional exposure even when HTTPS is enabled. Complete URLs can be recorded by reverse proxies, HTTP access logs, monitoring systems, debugging middleware, or network appliances. This behavior is documented as an API requirement, but the implementation does not compensate by requiring encrypted transport or warning users against insecure endpoints. ### Attack Path 1. A user follows the documented configuration and sets `SYNOLOGY_URL` to an `http://` NAS address. 2. The client submits the username and password to the login endpoint over plaintext HTTP. 3. An attacker w ...[truncated 1338 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Change the default URL and all documentation examples to HTTPS: ```python URL = os.environ.get("SYNOLOGY_URL", "https://{nas_ip}:5001") ``` 2. Reject plaintext HTTP by default before any credentials are sent: ```python from urllib.parse import urlparse parsed = urlparse(self.url) if parsed.scheme != "https": raise ValueError("SYNOLOGY_URL must use HTTPS") ``` 3. If plaintext HTTP is indispensable for isolated development, require an explicit opt-in such as `SYNOLOGY_ALLOW_INSECURE_HTTP=true` and display a prominent warning. It should never be enabled by default. 4. Keep TLS certificate verification enabled. Do not introduce `verify=False`. For private NAS certificates, support a user-provided CA bundle or document how to install the NAS CA certificate. 5. If supported by the Synology API, transmit the SID through an authorization header or secure session cookie instead of the query string. 6. If the API strictly requires `_sid` in the URL, ensure HTTPS is mandatory and configure reverse proxies, access logs, exception handlers, and telemetry systems to redact the `_sid` parameter. 7. Invalidate the local SID after logout and rotate any credentials or sessions that may previously have traversed an untrusted HTTP connection. ]]>