T09 · Insecure Skill Coding Practices
- Location
scripts/test-api.sh:22- Finding
TLS Certificate Verification Disabled in API Test Script
- Content
View full analysis
Vulnerability Details
File Location:
scripts/test-api.sh, lines 22–38
Vulnerability Type: Improper TLS certificate validation
Risk Level: HighVulnerable Code
bash RESPONSE=$(curl -sk -w "\n%{http_code}" -X POST "$API_URL" \ -H "Content-Type: application/json" \ -H "X-API-Key: $TOOLWEB_API_KEY" \ -d '{ "org_name": "Test Manufacturing Corp", "sector": "Manufacturing", "ot_size": "Medium", "integration_level": "Partial", "ot_technologies": ["SCADA", "PLC", "HMI"], "it_tools": ["Firewall", "SIEM"], "csf_scores": { "identify": 3, "protect": 2, "detect": 2, "respond": 1, "recover": 1 }, "threat_concern": "Ransomware targeting OT networks", "compliance": "IEC 62443" }')Technical Analysis
The
curlcommand uses the-koption, which is equivalent to--insecure. This disables validation of the server's TLS certificate and hostname. Consequently, the HTTPS connection provides encryption without reliable server authentication.The request transmits the
TOOLWEB_API_KEYin theX-API-Keyheader and sends OT security-assessment information in the body. Because any presented certificate is accepted, an attacker capable of intercepting or redirecting network traffic can impersonateportal.toolweb.in, terminate the TLS connection, and inspect or modify the request and response.Attack Path
- An attacker obtains a network interception position or influences DNS, proxy, gateway, or routing behavior.
- The attacker redirects the connection intended for
portal.toolweb.in:8443to an attacker-controlled endpoint. - The attacker presents an arbitrary or self-signed TLS certificate.
- The script accepts that certificate because
curl -kdisables certificate and hostname verification. - The attacker captures the
X-API-Keyheader and submitted assessment data. - The attacker ma ...[truncated 892 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove the
-koption and retain normal certificate and hostname validation:bash RESPONSE=$(curl -sS -w "\n%{http_code}" -X POST "$API_URL" \ -H "Content-Type: application/json" \ -H "X-API-Key: $TOOLWEB_API_KEY" \ -d '{ "org_name": "Test Manufacturing Corp", "sector": "Manufacturing", "ot_size": "Medium", "integration_level": "Partial", "ot_technologies": ["SCADA", "PLC", "HMI"], "it_tools": ["Firewall", "SIEM"], "csf_scores": { "identify": 3, "protect": 2, "detect": 2, "respond": 1, "recover": 1 }, "threat_concern": "Ransomware targeting OT networks", "compliance": "IEC 62443" }') -
Configure the server with a certificate whose trust chain and hostname are valid for
portal.toolweb.in. -
If a private certificate authority is required, install its CA certificate securely and use
--cacertrather than disabling validation globally. -
Fail closed on TLS errors; do not automatically retry with insecure certificate handling.
-
Consider public-key pinning with
--pinnedpubkeywhere operationally appropriate, while maintaining a documented certificate-rotation process. -
Rotate the API key if the vulnerable script has been executed over an untrusted network.
-
Store the API key through protected secret injection, restrict configuration-file permissions, and grant the key only the minimum API permissions and quota required.
-