T09 · Insecure Skill Coding Practices
Error
- Location
src/index.ts:186- Finding
Connection-String Peer Identity Is Not Authenticated
- Content
View full analysis
{ const { address } = parseConnectionString(connStr); const ws = await this.transport.connect(address); const noise = new NoiseXXHandshake(this.keyPair); const msg1 = noise.writeMessage1(); ``` ```ts // src/protocol.ts:9-13 export function parseConnectionString(connStr: string): { publicKey: string; address: string } { const match = connStr.match(/^clawdio:\/\/([a-f0-9]+)@(.+)$/i); if (!match) throw new Error(`Invalid connection string: ${connStr}`); return { publicKey: match[1], address: match[2] }; } ``` ### Technical Analysis A connection string contains both an advertised static public key and a network address. Although `parseConnectionString()` extracts the public key, `exchangeKeys()` discards it and retains only the address. The Noise XX handshake discovers the remote static key during the handshake, but the discovered key is never compared with the key advertised in the connection string. In addition, outbound connections are automatically accepted and added to the trusted-peer map. Encryption therefore protects the resulting session, but it does not authenticate that the responder is the peer named by the supplied connection string. An attacker able to redirect or intercept the plaintext `ws://` connection can complete the handshake with an attacker-controlled static key. The caller receives the attacker's peer ID and may treat the connection as the intended endpoint. ### Attack Path 1. A victim obtains a legitimate connection string containing the intended peer's public key and address. 2. An attacker gains the ability to redirect or intercept the plaintext WebSocket connection, such as through DNS, routing, proxy, or local-network mani ...[truncated 1181 chars]- Remediation
View remediation