T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/lakewatch_api_config.yaml:48
- Finding
- Credential-bearing API connections disable TLS certificate verification by default## Vulnerability Details **File Location**: `scripts/lakewatch_api_config.yaml:48`, `scripts/manager_api_config.yaml:56`, `scripts/lakewatch_api_client.py:158-165, 208-224`, `scripts/manager_api_client.py:160-167, 238-252` **Vulnerability Type**: Improper certificate validation exposing authentication credentials **Risk Level**: High ### Vulnerable Code Both shipped configurations disable TLS verification: ```yaml # scripts/lakewatch_api_config.yaml:48 verify_ssl: false ``` ```yaml # scripts/manager_api_config.yaml:56 verify_ssl: false ``` Both clients honor that setting by disabling hostname and certificate validation: ```python def _build_ssl_context(config: dict) -> ssl.SSLContext: """根据配置构建 SSL 上下文，支持跳过验证和自定义 CA 证书""" ctx = ssl.create_default_context() verify_ssl = config.get("crypto", {}).get("verify_ssl", True) if not verify_ssl: ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE else: ca_cert = config.get("crypto", {}).get("ca_cert", "") if ca_cert and os.path.isfile(ca_cert): ctx.load_verify_locations(ca_cert) return ctx ``` The LakeWatch client decrypts and sends the account password in the request body: ```python password = decrypt(encrypted_password, self.config) url = f"{scheme}://{host}:{port}/lakewatch/v1/system/get-token" payload = json.dumps({"username": username, "password": password}).encode("utf-8") ctx = _build_ssl_context(self.config) req = urllib.request.Request( url=url, data=payload, headers={"Content-Type": "application/json"}, method="POST", ) try: res = urllib.request.urlopen(req, context=ctx) ``` The Manager client sends reusable account credentials through HTTP Basic authentication: ```python _cred_bytes = b":".join([username.encode("utf-8"), password.encode("utf-8")]) credentials = base64.b64encode(_cred_bytes).decode("utf-8") del _cred_bytes req = urllib.request.Request( url=url, data=b"", headers={ "Con ...[truncated 2316 chars]
- Remediation
- ## Remediation Suggestions 1. Change `verify_ssl` to `true` in both shipped configuration files. 2. Require a valid private CA certificate through `ca_cert` for deployments using self-signed or internally issued certificates. 3. Fail closed if the configured CA file is missing or invalid; do not silently fall back to disabled verification. 4. If insecure TLS is retained for exceptional diagnostics, require an explicit per-invocation flag with a prominent warning rather than a persistent default. 5. Consider refusing to transmit passwords or Basic authentication credentials whenever certificate validation is disabled. 6. Rotate all credentials that may previously have been transmitted using the insecure default. 7. Add automated tests verifying that the default SSL context uses `CERT_REQUIRED` and performs hostname validation.