T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/feishu_image.py:33
- Finding
- TLS Certificate and Hostname Verification Disabled for All Feishu API Requests## Vulnerability Details **File Location**: `scripts/feishu_image.py`, lines 33–36; the insecure context is used at lines 79, 134, 173, 195, and 231 **Vulnerability Type**: Improper TLS certificate validation **Risk Level**: High ### Vulnerable Code ```python # Create a context that does not verify SSL certificates SSL_CONTEXT = ssl.create_default_context() SSL_CONTEXT.check_hostname = False SSL_CONTEXT.verify_mode = ssl.CERT_NONE ``` The context is passed to every Feishu API request, for example: ```python with urllib.request.urlopen(req, timeout=30, context=SSL_CONTEXT) as resp: result = json.loads(resp.read().decode("utf-8")) ``` Equivalent uses occur in token acquisition, image upload, message delivery, image download, and image viewing. ### Technical Analysis Setting `check_hostname` to `False` prevents verification that the server certificate belongs to `open.feishu.cn`. Setting `verify_mode` to `ssl.CERT_NONE` disables certificate-chain validation. Consequently, TLS encrypts the connection but does not authenticate the remote endpoint. This affects all requests made by the script. Of particular concern, the token endpoint receives the Feishu `app_id` and `app_secret` in the request body. Subsequent operations transmit the tenant bearer token, uploaded image contents, recipient identifiers, image keys, and message data. A network-positioned attacker who can intercept or redirect traffic can present an arbitrary certificate, impersonate the Feishu API, and read or modify these requests. No certificate warning or validation failure will stop the connection. The base64 conversion in the `view` command is not independently malicious: it encodes downloaded image bytes for the documented local output behavior. Likewise, communication with the fixed Feishu API endpoint is required by the declared functionality. The security issue is that these necessary communications occur without authenticating the endpoin ...[truncated 1774 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the global context that disables certificate and hostname verification. 2. Use Python's default verified TLS behavior: ```python with urllib.request.urlopen(req, timeout=30) as resp: result = json.loads(resp.read().decode("utf-8")) ``` 3. Apply the same change to every request at lines 79, 134, 173, 195, and 231. 4. If a custom certificate authority is genuinely required, create a validating context using an explicitly trusted CA bundle: ```python SSL_CONTEXT = ssl.create_default_context(cafile="/path/to/trusted-ca.pem") ``` Keep hostname verification enabled and use `ssl.CERT_REQUIRED`. 5. Do not use `ssl.CERT_NONE` or disable `check_hostname` as a workaround for local certificate-store problems. Repair the host CA store or configure the correct CA bundle instead. 6. Avoid exposing credentials or bearer tokens in exceptions and logs. Maintain the current behavior of not printing them directly. 7. After deploying the fix, rotate the Feishu application secret and revoke or refresh relevant tokens if the insecure version was used on an untrusted network. 8. Add an automated test that connects to an endpoint with an untrusted or hostname-mismatched certificate and verifies that the request fails.