T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/lakewatch_api_config.yaml:48
- Finding
- TLS Certificate Verification Disabled for Credential-Bearing API Requests## Vulnerability Details **File Location**: `scripts/lakewatch_api_config.yaml:48`, `scripts/manager_api_config.yaml:56`, `scripts/lakewatch_api_client.py:160-164`, `scripts/manager_api_client.py:162-166` **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code `scripts/lakewatch_api_config.yaml:48`: ```yaml verify_ssl: false ``` `scripts/manager_api_config.yaml:56`: ```yaml verify_ssl: false ``` `scripts/lakewatch_api_client.py:160-164`: ```python ctx = ssl.create_default_context() verify_ssl = config.get("crypto", {}).get("verify_ssl", True) if not verify_ssl: ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE ``` `scripts/manager_api_client.py:162-166`: ```python ctx = ssl.create_default_context() verify_ssl = config.get("crypto", {}).get("verify_ssl", True) if not verify_ssl: ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE ``` The LakeWatch client subsequently sends the decrypted username and password to the configured endpoint in `scripts/lakewatch_api_client.py:207-224`: ```python encrypted_password = auth["encrypted_password"] if not encrypted_password: raise RuntimeError("encrypted_password not set in config") password = decrypt(encrypted_password, self.config) url = f"{scheme}://{host}:{port}/lakewatch/v1/system/get-token" payload = json.dumps({"username": username, "password": password}).encode("utf-8") ctx = _build_ssl_context(self.config) req = urllib.request.Request( url=url, data=payload, headers={"Content-Type": "application/json"}, method="POST", ) try: res = urllib.request.urlopen(req, context=ctx) ``` ### Technical Analysis Both shipped configurations set `verify_ssl` to `false`. The corresponding SSL-context builders respond by disabling hostname checking and setting the verification mode to `ssl.CERT_NONE`. Encryption without certif ...[truncated 2119 chars]
- Remediation
- ## Remediation Suggestions 1. Change both shipped configurations to use certificate verification by default: ```yaml crypto: verify_ssl: true ca_cert: "/path/to/trusted/internal-ca.pem" ``` 2. Require a valid system-trusted certificate or an explicitly configured internal CA for private deployments. 3. Fail closed when the CA file is missing, malformed, or cannot validate the configured endpoint. 4. Do not transmit passwords, Basic credentials, tokens, or cookies when `ssl.CERT_NONE` is active. 5. If an exceptional insecure mode must remain available, require an explicit per-invocation opt-in, display a prominent warning, and prohibit credential-bearing requests in that mode. 6. Add tests confirming that untrusted certificates, expired certificates, and hostname mismatches are rejected.