T09 · Insecure Skill Coding Practices
Error
- Location
- credentials.json:1
- Finding
- Plaintext Default Administrative Credentials and Insecure Authentication Transport<![CDATA[ ## Vulnerability Details **File Location**: `credentials.json:1-20`; related insecure setup instructions in `SKILL.md:13-46` and `SKILL.md:231-245` **Vulnerability Type**: Hardcoded weak credentials and plaintext transmission of authentication secrets **Risk Level**: High ### Vulnerable Code `credentials.json:1-20`: ```json [ { "name": "Server Thingsboard", "url": "http://localhost:8080", "account": [ { "sysadmin": { "email": "sysadmin@thingsboard.org", "password": "sysadmin" } }, { "tenant": { "email": "tenant@thingsboard.org", "password": "tenant" } } ] } ] ``` Related instructions in `SKILL.md:13-46`: ```markdown 1. Configure your ThingsBoard server in `credentials.json`: ```json [ { "name": "Server Thingsboard", "url": "http://localhost:8080", "account": [ { "sysadmin": { "email": "sysadmin@thingsboard.org", "password": "sysadmin" } }, { "tenant": { "email": "tenant@thingsboard.org", "password": "tenant" } } ] } ] ``` 2. Set environment variables: ```bash export TB_URL="http://localhost:8080" export TB_USERNAME="tenant@thingsboard.org" export TB_PASSWORD="tenant" ``` 3. Get authentication token: ```bash export TB_TOKEN=$(curl -s -X POST "$TB_URL/api/auth/login" \ -H "Content-Type: application/json" \ -d "{\"username\":\"$TB_USERNAME\",\"password\":\"$TB_PASSWORD\"}" | jq -r '.token') ``` ``` ### Technical Analysis The distributed project contains plaintext credentials for the ThingsBoard system administrator and tenant accounts. The passwords are predictable defaults matching their account roles. The ...[truncated 2644 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `credentials.json` containing usable passwords from the distributed package and source-control history. 2. Replace it with a redacted template such as `credentials.example.json`, using placeholders rather than valid-looking defaults. 3. Add `credentials.json`, token files, and other local secret files to `.gitignore` and packaging exclusion rules. 4. Require unique, randomly generated passwords during installation. Do not permit the documented defaults to remain active. 5. Rotate both listed passwords and revoke all JWTs or refresh tokens issued from them. 6. Store production secrets in an operating-system credential store, deployment secret manager, or restricted runtime secret injection mechanism. 7. Avoid persistent plaintext environment variables where stronger secret-injection facilities are available. Never print credentials or JWTs to logs. 8. Require HTTPS for all non-loopback ThingsBoard URLs. Validate `TB_URL` and reject remote `http://` endpoints rather than merely recommending HTTPS. 9. Validate TLS certificates and do not introduce options such as `curl -k` that disable certificate verification. 10. Use a least-privileged tenant or service account for routine operations; reserve sysadmin credentials for explicit administrative tasks. 11. Require explicit user confirmation before destructive or exposure-changing operations, including telemetry deletion and making dashboards public. 12. Add automated secret scanning and configuration checks to CI to prevent future commits containing passwords, tokens, or insecure remote HTTP endpoints. ]]>