T09 · Insecure Skill Coding Practices
- Location
scripts/collect_all.py:168- Finding
TLS Certificate Verification Disabled for Authenticated Kubernetes API Requests
- Content
View full analysis
Vulnerability Details
File Location:
scripts/collect_all.py, lines 168–179
Vulnerability Type: Improper Certificate Validation
Risk Level: MediumComplete Code Snippet
python url = f"https://{host}{uri}" t, auth = _sign_aksk("GET", uri, host, HWC_AK, HWC_SK) cmd = [ "curl", "-s", "-k", "-H", f"X-Access-Key: {HWC_AK}", "-H", f"X-Sdk-Date: {t}", "-H", f"Authorization: {auth}", "-H", f"Host: {host}", url ] r = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True, timeout=30)Technical Analysis
The
k8s_api()request includescurl's-koption, which disables TLS certificate and hostname verification. The request nevertheless carries the Huawei Cloud access-key identifier and a signedAuthorizationheader.This path is reached during normal collection when Huawei Cloud AK/SK credentials are configured. It is used to retrieve Kubernetes resources, including nodes, pods, deployments, services, security contexts, RBAC-related information, and ingress configuration.
Because server identity is not verified, an attacker capable of intercepting or redirecting the connection can impersonate the intended API endpoint. The request signature may prevent arbitrary modification of a request, but it does not restore server authentication or protect the response from forgery.
Attack Path
- The user configures Huawei Cloud AK/SK credentials and invokes the collection workflow.
collect_all.pyconstructs an HTTPS URL for the cluster API endpoint.- The script signs the GET request and invokes
curl -k. - A network-positioned attacker redirects or intercepts the connection and presents an arbitrary certificate.
- Certificate verification succeeds unconditionally because of
-k. - The attacker receives the authenticated request headers and can return forged Kubernetes API responses.
- The forged data is consumed by the collector and written into assessment art ...[truncated 958 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the insecure
-koption and require normal CA-chain and hostname validation:
python cmd = [ "curl", "-sS", "--fail", "-H", f"X-Access-Key: {HWC_AK}", "-H", f"X-Sdk-Date: {t}", "-H", f"Authorization: {auth}", "-H", f"Host: {host}", url ]-
If the endpoint requires a private certificate authority, accept an explicitly configured CA bundle and pass it through
--cacert. Do not disable verification globally. -
Fail closed when certificate validation fails. Do not silently retry with insecure TLS settings.
-
Avoid placing authentication headers in child-process command-line arguments where practical. Use an HTTP client library with TLS verification enabled and headers supplied through its API, or provide curl headers through a securely permissioned temporary configuration or input channel.
-
Add tests confirming that:
- Untrusted certificates are rejected.
- Hostname mismatches are rejected.
- Valid certificates from the configured trust store succeed.
- No fallback path reintroduces
-kor equivalent insecure behavior.
- Remove the insecure