T09 · Insecure Skill Coding Practices
Error
- Location
scripts/health.sh:4- Finding
Basic Authentication Credentials and SMS Data Transmitted over Plaintext HTTP
- Content
View full analysis
:`. - Local Server supports Basic Auth only; include credentials in every request. - Validate connectivity first with `GET /health`, then list devices with `GET /devices`. ``` The documented configuration is used directly by scripts such as `scripts/health.sh`: ```bash BASE_URL="${SMS_GATE_BASE_URL:-}" USER="${SMS_GATE_USER:-}" PASS="${SMS_GATE_PASS:-}" if [[ -z "$BASE_URL" ]]; then echo "SMS_GATE_BASE_URL is required"; exit 1; fi if [[ -z "$USER" ]]; then echo "SMS_GATE_USER is required"; exit 1; fi if [[ -z "$PASS" ]]; then echo "SMS_GATE_PASS is required"; exit 1; fi BASE_URL="${BASE_URL%/}" curl -sS -u "$USER:$PASS" "$BASE_URL/health" ``` Equivalent authenticated requests occur in every script in the `scripts/` directory. ### Technical Analysis HTTP Basic Authentication encodes the username and password but does not encrypt them. The project explicitly documents an `http://` base URL and passes credentials to curl using `-u`. When that documented configuration is used, gateway credentials and API traffic are transmitted without transport confidentiality or server authentication. The exposed traffic may include: - The SMS gateway username and password. - Message text and recipient phone numbers. - Inbox and message history. - Device identifiers and status information. - Webhook URLs and event configuration. - Requests to send messages or delete webhooks. The scripts neither require HTTPS nor restrict plaintext HTTP connections to loopback. They also provide no explicit warning or opt-in requirement before credentials are sent over plaintext transport. ### Attack Path 1. A user follows the do ...[truncated 1621 chars]- Remediation
View remediation