T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ha_call.sh:42- Finding
Long-Lived Home Assistant Token Can Be Transmitted over Plaintext HTTP
- Content
View full analysis
&2 exit 1 fi done attempt_request() { local base_url="$1" if [[ "$METHOD" == "GET" ]]; then curl -sS \ --connect-timeout 8 \ --max-time 20 \ -H "Authorization: Bearer $HA_TOKEN" \ -H "Content-Type: application/json" \ "$base_url$PATH_PART" else curl -sS -X "$METHOD" \ --connect-timeout 8 \ --max-time 20 \ -H "Authorization: Bearer $HA_TOKEN" \ -H "Content-Type: application/json" \ -d "$DATA" \ "$base_url$PATH_PART" fi } ``` ### Technical Analysis The URL validation explicitly accepts both HTTPS and plaintext HTTP destinations. Every request then places the long-lived Home Assistant token in the `Authorization` header. Plaintext HTTP provides neither transport confidentiality nor server authentication. Although HTTP can be reasonable for an intentionally trusted local Home Assistant network, the implementation does not restrict it to loopback, link-local, or private-network addresses. It can therefore send the token to a public or otherwise untrusted HTTP endpoint configured through `HA_URL`, `HA_URL_LOCAL`, or `HA_URL_PUBLIC`. The network operation itself is necessary for the declared functionality. In particular, `scripts/ha_entity_find.sh` legitimately calls `GET /api/states` and filters the returned entity data locally. The security issue is not the presence of network access, but the absence of sufficiently strict transport protection for the bearer credential. ### Attack Path 1. A user configures a Home Assistant URL using `http://`, or an attacker modifies the relevant enviro ...[truncated 1159 chars]- Remediation
View remediation