T09 · Insecure Skill Coding Practices
- Location
scripts/send.js:17- Finding
SMTP TLS Certificate Validation Is Disabled
- Content
View full analysis
Vulnerability Details
File Location:
scripts/send.js, lines 17–21
Vulnerability Type: Improper TLS certificate validation
Risk Level: HighVulnerable Code
js tls: { rejectUnauthorized: false, servername: 'smtp.exmail.qq.com', },Technical Analysis
The SMTP transport explicitly sets
rejectUnauthorizedtofalse. Although the connection uses TLS on port 465, this setting disables validation of the SMTP server's certificate chain. The client can therefore accept a self-signed, expired, or otherwise untrusted certificate.This undermines server authentication and makes the connection vulnerable to an active man-in-the-middle attack. The
servernameoption does not compensate for disabled certificate validation.Attack Path
- An attacker obtains a privileged network position or manipulates DNS/routing for
smtp.exmail.qq.com. - The attacker redirects the SMTP connection to a server presenting an untrusted certificate.
- The client accepts that certificate because
rejectUnauthorizedis disabled. - The client transmits the configured mailbox account and authorization code during SMTP authentication.
- The attacker may capture credentials and outgoing email content, then relay or manipulate the SMTP session to reduce the chance of detection.
Impact Assessment
A successful attacker could obtain the
EXMAIL_ACCOUNTvalue, the mailbox authorization code, recipient addresses, subjects, and message bodies sent through the Skill. Depending on the permissions associated with the authorization code, credential compromise could enable unauthorized mailbox access or email transmission.Exploitation requires control over or interference with the victim's network, DNS, proxy, or routing path. The flaw does not itself grant local operating-system privileges.
The network access in
scripts/get-body.jsis not considered unauthorized behavior: it sends credentials to the documented Tencent Exmail IMAP endpoint over TL ...[truncated 92 chars]- An attacker obtains a privileged network position or manipulates DNS/routing for
- Remediation
View remediation
Remediation Suggestions
Remove the custom option that disables certificate verification and rely on secure defaults:
js const transporter = nodemailer.createTransport({ host: 'smtp.exmail.qq.com', port: 465, secure: true, auth: { user: account, pass: authCode, }, tls: { servername: 'smtp.exmail.qq.com', rejectUnauthorized: true, }, });Alternatively, omit the
tlsblock entirely if no custom TLS configuration is required. The application should fail closed when the certificate is expired, untrusted, or does not match the expected hostname.If a private trust chain is genuinely required, configure a narrowly scoped trusted CA certificate rather than disabling verification globally. Avoid logging authentication secrets, and rotate the mailbox authorization code if the Skill was previously used over an untrusted network.