T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/lerwee_api.py:18
- Finding
- Sensitive API and Administrative Data Can Be Transmitted Over Plaintext HTTP## Vulnerability Details **File Location**: `scripts/lerwee_api.py:18-30, 74-80`; related insecure defaults in `README.md:23-24, 39-40`, `SKILL.md:16, 22, 238-239, 257, 265`, and `references/config.json:1-6` **Vulnerability Type**: Cleartext transmission of sensitive information **Risk Level**: High ### Vulnerable Code ```python def __init__(self, base_url: str, secret: str): """ 初始化客户端 Args: base_url: API 基础地址 (如: http://192.168.1.79:8081/api/v6) secret: API 密钥 """ self.base_url = base_url.rstrip('/') self.secret = secret self.session = requests.Session() self.session.headers.update({ 'Content-Type': 'application/json', 'Accept': 'application/json' }) ``` ```python url = f"{self.base_url}{endpoint}" response = self.session.post(url, json=params, timeout=30) response.raise_for_status() return response.json() ``` The distributed configuration also explicitly selects HTTP: ```json { "base_url": "http://192.168.1.79:8081/api/v6", "secret": "", "timeout": 30, "retry": 3 } ``` ### Technical Analysis The client accepts any URL scheme and submits the complete JSON request body through `requests.Session.post`. The documented and configured default URL uses unencrypted HTTP rather than HTTPS. The generic request method is used for sensitive operations, including requests containing SSH passwords, user account passwords, API signatures, monitoring information, and destructive administrative commands. The request signature only attempts to establish request authenticity; it does not encrypt request content or prevent passive traffic inspection. An attacker with access to the same network path, such as a compromised gateway, malicious Wi-Fi access point, local network peer capable of address-resolution poisoning, or upstream network observer, can inspect plaintext requests and responses. Because HTTP provides no ...[truncated 1397 chars]
- Remediation
- ## Remediation Suggestions 1. Require HTTPS for all non-test endpoints and reject `http://` URLs during client initialization. 2. Replace every documented and distributed default with an `https://` URL. 3. Keep TLS certificate verification enabled and do not introduce `verify=False`. 4. Support a deliberately configured private certificate authority where internal deployments use private PKI. 5. Avoid placing reusable SSH passwords in API requests where key-based or short-lived authentication is available. 6. Add tests that verify client initialization fails for plaintext URLs unless an explicit, prominently warned local-development override is supplied. 7. Rotate any credentials previously transmitted over plaintext networks. 8. Consider application-level encryption for especially sensitive deployment credentials in addition to TLS.