T09 · Insecure Skill Coding Practices
Error
- Location
scripts/unifi-api.sh:33- Finding
TLS Certificate Verification Disabled for Authentication and API Requests
- Content
View full analysis
/dev/null ``` ```bash curl -sk -b "$UNIFI_COOKIE_FILE" "$full_url" ``` ### Technical Analysis The `-k` option instructs `curl` to accept an HTTPS certificate without verifying its trust chain or hostname. It is applied both when transmitting the administrator username and password and when making requests with the authenticated session cookie. Although self-signed certificates are common on local UniFi gateways, globally disabling certificate verification removes server authentication. Encryption alone does not protect these requests against an active man-in-the-middle attacker. The implementation also does not validate that `UNIFI_URL` uses HTTPS. ### Attack Path 1. A user configures the Skill with valid UniFi administrator credentials. 2. An attacker gains a position from which local traffic can be intercepted, such as through ARP spoofing, DNS manipulation, a compromised access point, or a malicious local gateway. 3. The attacker presents an arbitrary TLS certificate while impersonating the configured UniFi gateway. 4. Because `curl -k` accepts that certificate, the script sends the JSON login payload containing the username and password to the attacker. 5. The attacker may also capture the authenticated session cookie and API responses. 6. The stolen credentials or cookie are then used to access the real UniFi controller. ### Impact Assessment Successful exploitation can disclose UniFi administrator credentials, authenticated session cookies, client inventories, internal addresses, device identifiers, WLAN configuration, firewall rules, routes, and port-forwarding details. Because the documented setup asks for a local administra ...[truncated 119 chars]- Remediation
View remediation