T09 · Insecure Skill Coding Practices
Error
- Location
index.js:2- Finding
Beszel Credentials and Authorization Tokens Transmitted over Plaintext HTTP
- Content
View full analysis
{ const options = { hostname: new URL(CONFIG.host).hostname, port: new URL(CONFIG.host).port, path: path, method: method, headers: { 'Content-Type': 'application/json', } }; if (token) { options.headers['Authorization'] = token; } const req = https.request(options, (res) => { ``` ```js // 1. Authenticate const auth = await request('/api/collections/users/auth-with-password', 'POST', { identity: CONFIG.email, password: CONFIG.password }); if (!auth.token) { console.error('Authentication failed:', auth); process.exit(1); } const token = auth.token; ``` ### Technical Analysis The variable named `https` imports Node.js's plaintext `http` module rather than the `https` module. All requests therefore use unencrypted HTTP, including the authentication request containing `BESZEL_USER` and `BESZEL_PASS` and subsequent requests containing the authorization token. The implementation extracts only the hostname and port from `BESZEL_HOST`; it does not use the configured URL protocol to select a transport. Consequently, setting `BESZEL_HOST` to an `https://` URL does not enable TLS. The code will still attempt a plaintext HTTP connection to the selected host and port. Sending authentication material to the configured Beszel endpoint is necessary for the declared monitoring functionality. However, sending reusable credentials and tokens without transport encryption is not necessary and ...[truncated 1551 chars]- Remediation
View remediation