T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/ha_call.sh:42
- Finding
- Long-Lived Home Assistant Token Can Be Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ha_call.sh:42-65` **Vulnerability Type**: Plaintext transmission of sensitive authentication credentials **Risk Level**: Medium ### Vulnerable Code ```bash for base in "${CANDIDATES[@]}"; do if [[ "$base" != http://* && "$base" != https://* ]]; then echo "Error: Invalid URL scheme in '$base'. Use http:// or https://" >&2 exit 1 fi done attempt_request() { local base_url="$1" if [[ "$METHOD" == "GET" ]]; then curl -sS \ --connect-timeout 8 \ --max-time 20 \ -H "Authorization: Bearer $HA_TOKEN" \ -H "Content-Type: application/json" \ "$base_url$PATH_PART" else curl -sS -X "$METHOD" \ --connect-timeout 8 \ --max-time 20 \ -H "Authorization: Bearer $HA_TOKEN" \ -H "Content-Type: application/json" \ -d "$DATA" \ "$base_url$PATH_PART" fi } ``` ### Technical Analysis The URL validation explicitly accepts both HTTPS and plaintext HTTP destinations. Every request then places the long-lived Home Assistant token in the `Authorization` header. Plaintext HTTP provides neither transport confidentiality nor server authentication. Although HTTP can be reasonable for an intentionally trusted local Home Assistant network, the implementation does not restrict it to loopback, link-local, or private-network addresses. It can therefore send the token to a public or otherwise untrusted HTTP endpoint configured through `HA_URL`, `HA_URL_LOCAL`, or `HA_URL_PUBLIC`. The network operation itself is necessary for the declared functionality. In particular, `scripts/ha_entity_find.sh` legitimately calls `GET /api/states` and filters the returned entity data locally. The security issue is not the presence of network access, but the absence of sufficiently strict transport protection for the bearer credential. ### Attack Path 1. A user configures a Home Assistant URL using `http://`, or an attacker modifies the relevant enviro ...[truncated 1159 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require HTTPS for `HA_URL_PUBLIC` and any destination that is not demonstrably local. 2. If plaintext local access must remain supported, require an explicit opt-in such as `HA_ALLOW_INSECURE_LOCAL_HTTP=1`. 3. Resolve the hostname and permit HTTP only for loopback, link-local, or approved private-network destinations. Account for DNS rebinding and redirects. 4. Add `--proto '=https'` for public requests and disable redirects, or use `--proto-redir '=https'` if redirects are required. 5. Consider certificate pinning or a configurable private certificate authority for sensitive deployments. 6. Emit a prominent warning whenever HTTP is explicitly enabled. 7. Document that the Home Assistant token should use the minimum permissions necessary and should be rotated immediately if transmitted over an untrusted network. 8. Apply the same URL and transport validation consistently in `scripts/self_check.sh`. ]]>