T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/clawpaw_controller.py:60
- Finding
- Privileged Android Control Uses Unauthenticated Cleartext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/clawpaw_controller.py`, lines 60-122 **Vulnerability Type**: Cleartext transmission of sensitive data and privileged commands **Risk Level**: High ### Vulnerable Code ```python self.base_url = f"http://{self.host}:{self.port}" ``` ```python def get_layout(self) -> str: """ 获取当前界面布局（XML） Returns: 解码后的 XML 布局字符串 """ resp = requests.get(f"{self.base_url}/api/layout", timeout=self.timeout) data = resp.json() layout_b64 = data.get("layout", "") return base64.b64decode(layout_b64).decode("utf-8", errors="ignore") ``` ```python def get_screenshot(self, save_path: Optional[str] = None) -> bytes: """ 获取截图 Args: save_path: 可选，保存截图到文件 Returns: 截图的 PNG 数据 """ resp = requests.get(f"{self.base_url}/api/screenshot", timeout=self.timeout) data = resp.json() screenshot_b64 = data.get("screenshot", "") png_data = base64.b64decode(screenshot_b64) if save_path: with open(save_path, "wb") as f: f.write(png_data) return png_data ``` ```python def execute(self, action: str, **kwargs) -> Dict[str, Any]: """ 执行命令 Args: action: 动作类型 (click, input_text, swipe, back, open_amap, screenshot, get_layout) **kwargs: 动作参数 Returns: 执行结果 """ payload = {"action": action, **kwargs} resp = requests.post( f"{self.base_url}/api/execute", json=payload, timeout=self.timeout ) return resp.json() ``` ### Technical Analysis The direct-control client constructs every device API URL with the `http://` scheme. It does not attach an authentication token, verify a server identity, encrypt the transport, or implement request integrity and replay protection. These API requests can contain or return highly sensitive information, including: - Screen captures and accessibility layout XML - Text entered into applications - Location, notific ...[truncated 1985 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require authenticated HTTPS for direct network connections. 2. Reject non-loopback `http://` endpoints unless the user explicitly enables an acknowledged development-only override. 3. Prefer an authenticated encrypted tunnel for local operation. 4. Add per-device authentication using short-lived, scoped credentials rather than a shared static secret. 5. Validate the server certificate and hostname; do not disable certificate verification. 6. Add request timestamps, nonces, and integrity protection to prevent replay. 7. Bind the phone service to the narrowest possible interface and restrict access with host firewall rules. 8. Separate read-only information operations from high-impact control operations and require stronger authorization for the latter. 9. Avoid returning layouts after every control operation unless explicitly requested, reducing unnecessary sensitive-data transfer. 10. Clearly warn users that direct WiFi mode exposes privileged device traffic unless transport security is configured. ]]>