T09 · Insecure Skill Coding Practices
Error
- Location
scripts/recamera_intellisense/device.py:74- Finding
Automatic Device Discovery Exposes Bearer Tokens over Unauthenticated Transports
- Content
View full analysis
Vulnerability Details
File Location:
scripts/recamera_intellisense/device.py, lines 74–81 and 105–145
Vulnerability Type: Credential exposure through automatic insecure transport fallback
Risk Level: HighVulnerable Code
python if use_tls: if allow_unsecured: ctx = _http.insecure_ssl_context(host) else: import ssl ctx = ssl.create_default_context() conn: http.client.HTTPConnection = http.client.HTTPSConnection( connect_host, port, timeout=timeout, context=ctx ) else: conn = http.client.HTTPConnection(connect_host, port, timeout=timeout) headers = {"Host": host_header} if token: headers["Authorization"] = tokenpython def detect_local_device( host: str, port: Optional[int] = None, *, token: str = "", timeout: float = _DEFAULT_PROBE_TIMEOUT, ) -> Optional[Dict[str, Any]]: """Probe *host* for a reCamera HTTP/HTTPS API. Tries HTTPS (validated), HTTPS (self-signed), then HTTP. Returns `None` if no reachable API is found. Auth failures count as "detected". """ _config.validate_host(host) _config.validate_token(token) host = host.strip() token = token.strip() or "" if port is not None: port = int(port) if not 1 <= port <= 65535: raise ValueError(f"Port {port} out of range.") timeout = float(timeout) if timeout <= 0: raise ValueError("timeout must be positive.") probes = [ ("https", port or 443, False), ("https", port or 443, True), ("http", port or 80, False), ] for protocol, probe_port, allow_unsecured in probes: if ( _probe( host, probe_port, token, use_tls=(protocol == "https"), allow_unsecured=allow_unsecured, timeout=timeout, auth_error_is_reachable=True, ) is None ): ...[truncated 2797 chars]- Remediation
View remediation
Remediation Suggestions
- Do not attach credentials during unauthenticated discovery. Perform initial reachability and protocol detection without the bearer token.
- Remove automatic insecure fallback when a token is present. If verified HTTPS fails, stop and require an explicit user decision before attempting unverified TLS or HTTP.
- Add an explicit insecure-transport option. Introduce an
allow_unsecuredparameter that defaults tofalse, and require it for both certificate-verification bypass and plaintext HTTP. - Prefer authenticated transport selection. Select and verify the endpoint first, then transmit the token only after the transport and server identity have been established.
- Prohibit plaintext credential transmission by default. Refuse HTTP discovery with a non-empty token unless the user explicitly authorizes it for a trusted network.
- Avoid persisting insecure discovery results silently. Before saving a profile discovered through unverified TLS or HTTP, require explicit approval and clearly identify the selected protocol and associated credential risk.
- Separate detection from authentication. A safe design is:
- Probe supported protocols without credentials.
- Return the detected candidates to the caller.
- Have the caller explicitly select a transport.
- Authenticate only over the selected, authorized transport.
- Add regression tests confirming that tokens are never included in requests made over plaintext HTTP or certificate-unverified TLS unless an explicit insecure option is enabled.