T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/test-api.sh:22
- Finding
- TLS Certificate Verification Disabled in API Test Script## Vulnerability Details **File Location**: `scripts/test-api.sh`, lines 22–38 **Vulnerability Type**: Improper TLS certificate validation **Risk Level**: High ### Vulnerable Code ```bash RESPONSE=$(curl -sk -w "\n%{http_code}" -X POST "$API_URL" \ -H "Content-Type: application/json" \ -H "X-API-Key: $TOOLWEB_API_KEY" \ -d '{ "org_name": "Test Manufacturing Corp", "sector": "Manufacturing", "ot_size": "Medium", "integration_level": "Partial", "ot_technologies": ["SCADA", "PLC", "HMI"], "it_tools": ["Firewall", "SIEM"], "csf_scores": { "identify": 3, "protect": 2, "detect": 2, "respond": 1, "recover": 1 }, "threat_concern": "Ransomware targeting OT networks", "compliance": "IEC 62443" }') ``` ### Technical Analysis The `curl` command uses the `-k` option, which is equivalent to `--insecure`. This disables validation of the server's TLS certificate and hostname. Consequently, the HTTPS connection provides encryption without reliable server authentication. The request transmits the `TOOLWEB_API_KEY` in the `X-API-Key` header and sends OT security-assessment information in the body. Because any presented certificate is accepted, an attacker capable of intercepting or redirecting network traffic can impersonate `portal.toolweb.in`, terminate the TLS connection, and inspect or modify the request and response. ### Attack Path 1. An attacker obtains a network interception position or influences DNS, proxy, gateway, or routing behavior. 2. The attacker redirects the connection intended for `portal.toolweb.in:8443` to an attacker-controlled endpoint. 3. The attacker presents an arbitrary or self-signed TLS certificate. 4. The script accepts that certificate because `curl -k` disables certificate and hostname verification. 5. The attacker captures the `X-API-Key` header and submitted assessment data. 6. The attacker ma ...[truncated 892 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `-k` option and retain normal certificate and hostname validation: ```bash RESPONSE=$(curl -sS -w "\n%{http_code}" -X POST "$API_URL" \ -H "Content-Type: application/json" \ -H "X-API-Key: $TOOLWEB_API_KEY" \ -d '{ "org_name": "Test Manufacturing Corp", "sector": "Manufacturing", "ot_size": "Medium", "integration_level": "Partial", "ot_technologies": ["SCADA", "PLC", "HMI"], "it_tools": ["Firewall", "SIEM"], "csf_scores": { "identify": 3, "protect": 2, "detect": 2, "respond": 1, "recover": 1 }, "threat_concern": "Ransomware targeting OT networks", "compliance": "IEC 62443" }') ``` 2. Configure the server with a certificate whose trust chain and hostname are valid for `portal.toolweb.in`. 3. If a private certificate authority is required, install its CA certificate securely and use `--cacert` rather than disabling validation globally. 4. Fail closed on TLS errors; do not automatically retry with insecure certificate handling. 5. Consider public-key pinning with `--pinnedpubkey` where operationally appropriate, while maintaining a documented certificate-rotation process. 6. Rotate the API key if the vulnerable script has been executed over an untrusted network. 7. Store the API key through protected secret injection, restrict configuration-file permissions, and grant the key only the minimum API permissions and quota required.