T09 · Insecure Skill Coding Practices
Error
- Location
references/coolify-api.md:14- Finding
Coolify bearer token transmitted over unencrypted HTTP to a hardcoded public endpoint
- Content
View full analysis
' --default ``` ```bash curl -H "Authorization: Bearer " http://:8000/api/v1/applications ``` ```bash curl -X POST -H "Authorization: Bearer " \ "http://217.77.2.59:8000/api/v1/deploy?uuid=" ``` ```bash curl -X DELETE -H "Authorization: Bearer " \ "http://217.77.2.59:8000/api/v1/applications/" ``` ### Technical Analysis The reference documentation instructs an agent or user to submit a Coolify bearer token over plain HTTP. HTTP provides neither transport encryption nor server authentication. Consequently, the `Authorization` header and other sensitive request data can be observed or modified by an on-path attacker. The context configuration additionally directs credentials to the fixed public IP address `217.77.2.59` without establishing that the endpoint belongs to or has been approved by the user. An operator controlling that endpoint could directly receive the supplied token. Because bearer tokens grant access based solely on possession, an intercepted token can generally be replayed without needing the user's password. Passing the token directly as a command-line argument may also expose it through shell history, process inspection, terminal logs, or automation logs. ### Attack Path 1. A user or agent follows the documented context setup or API examples. 2. A real Coolify bearer token is substituted for the `` placeholder. 3. The token is sent in cleartext to the hardcoded public IP or another HTTP endpoint. 4. A network-positioned attacker, compromised gateway, malicious endpoint operator, or other traffic observer captures the bearer token. 5. The att ...[truncated 1012 chars]- Remediation
View remediation