T09 · Insecure Skill Coding Practices
Error
- Location
- skill.md:23
- Finding
- Bearer API Tokens Are Transmitted over Unencrypted HTTP<![CDATA[ ## Vulnerability Details **File Locations**: - `skill.md:23-36, 50-51, 73-74, 102-107, 137-146, 172-181, 208-213, 238-239` - `README.md:28-37` - `openapi.json:9-15, 212-221` - `PUBLISH.md:29-32` **Vulnerability Type**: Cleartext transmission of sensitive authentication credentials **Risk Level**: High **Classification**: T09: Insecure Skill Coding Practices ### Vulnerable Code The main documentation defines Bearer-token authentication while specifying an unencrypted HTTP endpoint: ```markdown **Authentication method**: Bearer Token Authorization: Bearer <your-access-token> - **Base URL**: `http://88.222.241.169` ``` Authenticated examples in `skill.md` send the token directly over HTTP: ```bash curl "http://88.222.241.169/api/v1/group_ca/by-ca/7m3HtU4RDiXWpAt546HHC7Lho3Qzvz6tx2MiAmLiHpLn" \ -H "Authorization: Bearer YOUR_TOKEN" ``` ```bash curl "http://88.222.241.169/api/v1/group_ca/latest?limit=5" \ -H "Authorization: Bearer YOUR_TOKEN" ``` ```bash curl "http://88.222.241.169/api/v1/token/usage" \ -H "Authorization: Bearer YOUR_TOKEN" ``` The quick-start instructions in `README.md` repeat the insecure pattern: ```bash curl "http://88.222.241.169/api/v1/group_ca/by-ca/7m3HtU4..." \ -H "Authorization: Bearer YOUR_TOKEN" curl "http://88.222.241.169/api/v1/group_ca/latest?limit=5" \ -H "Authorization: Bearer YOUR_TOKEN" curl "http://88.222.241.169/api/v1/summaries?group_name=cryptoD&limit=10" \ -H "Authorization: Bearer YOUR_TOKEN" ``` The OpenAPI specification globally combines an HTTP server with Bearer authentication: ```json "servers": [ { "url": "http://88.222.241.169", "description": "Production server" } ] ``` ```json "components": { "securitySchemes": { "bearerAuth": { "type": "http", "scheme": "bearer" } } }, "security": [ { "bearerAuth": [] } ] ``` The publication metadata confirms the same configuration: ```markdown - **Protocol**: HTTP REST API - **Authentication**: B ...[truncated 3098 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Deploy HTTPS on the production API** - Assign the service a dedicated DNS hostname. - Install a certificate issued by a trusted certificate authority. - Permit authenticated API traffic only over TLS 1.2 or TLS 1.3. - Disable obsolete protocols and weak cipher suites. 2. **Update every documented endpoint** - Replace all occurrences of `http://88.222.241.169` with the canonical HTTPS origin. - Update `skill.md`, `README.md`, `PUBLISH.md`, and the OpenAPI `servers` entry. - Ensure generated Swagger clients also default exclusively to HTTPS. 3. **Do not rely on HTTP redirection to protect credentials** - Clients must send their initial authenticated request directly to HTTPS. - An HTTP-to-HTTPS redirect cannot protect a token already included in the original plaintext request. - Reject authentication headers received over insecure transport. 4. **Rotate potentially exposed credentials** - Revoke tokens that may have been used with the documented HTTP commands. - Issue replacement tokens only after HTTPS enforcement is active. - Reduce the documented one-year lifetime and support immediate revocation and routine rotation. 5. **Harden token handling** - Store only cryptographic hashes of API tokens on the server where feasible. - Use narrowly scoped tokens and apply least privilege. - Avoid recording Authorization headers in application, reverse-proxy, or monitoring logs. - Detect suspicious replay, unusual source changes, and abnormal quota consumption. 6. **Protect response integrity** - Enforce HTTPS for documentation and Swagger UI as well as API traffic. - Consider HSTS after confirming that all service paths support HTTPS. - For high-integrity automated financial workflows, consider signed responses or application-level authenticity checks in addition to TLS. ]]>