T09 · Insecure Skill Coding Practices
- Location
scripts/ha.sh:20- Finding
Long-Lived Home Assistant Bearer Token Can Be Transmitted over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ha.sh:20-22; insecure configuration documented atSKILL.md:23-28
Vulnerability Type: Plaintext transmission of sensitive authentication credentials
Risk Level: MediumThe documented environment-variable configuration explicitly permits an
http://Home Assistant endpoint:bash ### Option 2: Environment Variables ```bash export HA_URL="http://homeassistant.local:8123" export HA_TOKEN="your-long-lived-access-token"text The API wrapper subsequently sends the long-lived token in every request without checking whether TLS is enabled: ```bash api() { curl -s -H "Authorization: Bearer $HA_TOKEN" -H "Content-Type: application/json" "$@" }Technical Analysis
A bearer token grants access to any party possessing it. When
HA_URLuses HTTP, theAuthorization: Bearerheader is transmitted without transport encryption. The script accepts this configuration without rejection or warning and attaches the token to all API requests.An attacker with visibility or control over the network path—such as an adversary on the same wireless network, a compromised router, or a malicious network administrator—could intercept the request and recover the token. A network-positioned attacker could also modify plaintext requests or responses.
This issue does not independently escalate privileges beyond those assigned to the Home Assistant token. Its severity depends on the network environment and the permissions of the account that generated the token.
Attack Path
- A user follows the documented example and sets
HA_URLto anhttp://endpoint. - The user invokes a command such as
ha.sh info,ha.sh state, or a device-control operation. scripts/ha.shsends the long-lived token in the plaintext HTTPAuthorizationheader.- An attacker monitoring or controlling the network path captures the request and extracts the token.
- The ...[truncated 1002 chars]
- A user follows the documented example and sets
- Remediation
View remediation
Remediation Suggestions
- Require
https://endpoints by default and terminate with an explicit error whenHA_URLbegins withhttp://. - If plaintext HTTP must be supported for isolated development environments, require an explicit opt-in variable such as
HA_ALLOW_INSECURE_HTTP=1and display a prominent warning. - Replace the HTTP example in
SKILL.mdwith an HTTPS URL and clearly document that bearer tokens must not be sent over untrusted plaintext networks. - Configure Home Assistant with a valid TLS certificate or place it behind a trusted TLS-terminating reverse proxy.
- Use a dedicated, least-privileged Home Assistant account where deployment constraints permit, limiting the consequences of token compromise.
- Revoke and replace any token that may previously have been transmitted over an untrusted HTTP connection.
- Consider validating the URL before every request so an altered environment or configuration file cannot silently downgrade transport security. For example:
bash if [[ "$HA_URL" != https://* ]]; then if [[ "${HA_ALLOW_INSECURE_HTTP:-0}" != "1" ]]; then echo "Error: HA_URL must use HTTPS." >&2 exit 1 fi echo "Warning: transmitting the Home Assistant token over insecure HTTP." >&2 fi- Require