T09 · Insecure Skill Coding Practices
Error
- Location
- security-integration.md:100
- Finding
- TLS Certificate Verification Disabled for Authenticated UniFi Protect API Requests## Vulnerability Details **File Location**: `security-integration.md:100-106` **Vulnerability Type**: Improper TLS certificate validation **Risk Level**: High ### Vulnerable Code ```bash # Get cameras curl -k "https://unifi-protect:7443/proxy/protect/api/cameras" \ -H "Authorization: Bearer $TOKEN" # Snapshot curl -k "https://unifi-protect:7443/proxy/protect/api/cameras/{id}/snapshot" \ -o snapshot.jpg ``` ### Technical Analysis The documented commands use the `curl -k` option, which disables validation of the server's TLS certificate. Consequently, the client does not verify that it is communicating with the intended UniFi Protect server. The first request transmits an authorization bearer token over this unauthenticated TLS connection. Although traffic remains encrypted, an attacker able to intercept network communication can present an arbitrary certificate and establish a man-in-the-middle connection. The attacker could then read the bearer token and API response. The snapshot request is likewise vulnerable to interception or response manipulation. ### Attack Path 1. A user follows the documented command while connected to a network accessible to the attacker. 2. The attacker obtains a network interception position through a compromised gateway, malicious access point, DNS poisoning, or ARP spoofing. 3. The attacker redirects the UniFi Protect hostname or traffic to an attacker-controlled HTTPS endpoint. 4. Because `-k` disables certificate verification, `curl` accepts the attacker's certificate without reporting a trust failure. 5. The client sends the bearer token to the attacker-controlled endpoint. 6. The attacker replays the captured token against the actual UniFi Protect API, subject to the token's validity and assigned privileges. 7. The attacker can also intercept, replace, or collect camera metadata and snapshot content. ### Impact Assessment Successful exploitation can disclose the bea ...[truncated 391 chars]
- Remediation
- ## Remediation Suggestions - Remove `-k` from all `curl` commands. - Configure the client to trust the certificate authority that issued the UniFi Protect appliance certificate. - For a private CA, install its root certificate in the operating system trust store or pass it explicitly: ```bash curl --cacert /secure/path/unifi-ca.pem \ "https://unifi-protect:7443/proxy/protect/api/cameras" \ -H "Authorization: Bearer $TOKEN" ``` - Where operationally appropriate, use certificate or public-key pinning in addition to normal certificate validation. - Use a narrowly scoped, short-lived API token and rotate it immediately if it may have been exposed. - Store tokens in a protected secret manager or environment variable, and prevent command tracing and logs from recording authorization headers. - Ensure both metadata and snapshot requests perform certificate validation.