T09 · Insecure Skill Coding Practices
Error
- Location
scripts/device_reboot.py:25- Finding
Authentication Data and Device Token Can Be Redirected to an Arbitrary Endpoint
- Content
View full analysis
Dict[str, str]: """Generate request headers containing the signature and timestamp.""" time_millis = get_time_millis() signature = generate_signature(uuid, app_key, app_secret, time_millis, move_card) return { "Content-Type": "application/json; charset=UTF-8", "uuid": uuid, "appKey": app_key, "timeMillis": time_millis, "signature": signature, "X-Request-Id": os.urandom(16).hex() } def device_reboot(device_token: str, uuid: str, app_key: str, app_secret: str, move_card: int, action: str = "Reboot") -> Dict[str, Any]: url = f"{JF_BASE_URL}/rtc/device/opdev/{device_token}" headers = get_headers(uuid, app_key, app_secret, move_card) body = { "Name": "OPMachine", "OPMachine": { "Action": action } } response = requests.post(url, headers=headers, json=body, timeout=30) ``` ### Technical Analysis The destination hostname is read directly from the `JF_ENDPOINT` environment variable and interpolated into an HTTPS URL without validation. Although HTTPS verifies the certificate for the selected hostname, it does not establish that the hostname belongs to the intended service provider. An attacker-controlled domain with a valid certificate would therefore be accepted. Each request transmits the following authentication-related data to the configured endpoint: - User UUID - Application key - Timestamp - Request signature derived from ...[truncated 2175 chars]- Remediation
View remediation