T09 · Insecure Skill Coding Practices
Warning
- Location
- index.js:46513
- Finding
- Legacy Insecure TLS Renegotiation Enabled for All Bank Requests## Vulnerability Details **File Location**: `index.js`, lines 46513–46519 and 46559–46565 **Vulnerability Type**: Insecure TLS configuration **Risk Level**: Medium ```javascript let legacyTlsDispatcher; try { const { Agent } = __nccwpck_require__(6752); legacyTlsDispatcher = new Agent({ connect: { secureOptions: crypto.constants.SSL_OP_LEGACY_SERVER_CONNECT, }, }); } catch { legacyTlsDispatcher = undefined; } ``` The legacy-enabled dispatcher is then applied to every outbound request: ```javascript const response = await fetch(url, { method: options.method || 'GET', headers: { ...DEFAULT_HEADERS, ...(options.headers || {}), }, body: options.body, signal: AbortSignal.timeout(options.timeoutMs || DEFAULT_TIMEOUT_MS), ...(legacyTlsDispatcher ? { dispatcher: legacyTlsDispatcher } : {}), }); ``` ### Technical Analysis `SSL_OP_LEGACY_SERVER_CONNECT` permits the client to connect to servers that do not support secure TLS renegotiation. Secure renegotiation protects the relationship between the initial TLS handshake and subsequent renegotiated handshakes. Allowing the legacy behavior weakens Node.js and OpenSSL's default transport protections. The configured dispatcher is not restricted to a single documented legacy endpoint. It is passed to every request made through `fetchBuffer`, including requests to all six configured bank sources. Consequently, the skill globally relaxes TLS behavior even for endpoints that do not require this compatibility option. Exploitation depends on the contacted server or an intervening TLS endpoint supporting vulnerable legacy renegotiation and on an attacker being in a suitable network position. The hard-coded HTTPS destinations and normal certificate validation reduce exposure, but they do not justify globally enabling an obsolete TLS compatibility mode. ### Attack Path 1. A user invokes the skill to retrieve exchang ...[truncated 1291 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `crypto.constants.SSL_OP_LEGACY_SERVER_CONNECT` and use Node.js and OpenSSL's secure default TLS configuration. 2. Do not create or apply a legacy-enabled dispatcher globally. 3. Verify whether any configured bank endpoint genuinely requires insecure legacy renegotiation. Prefer a current official endpoint if compatibility problems exist. 4. If a temporary exception is unavoidable, isolate it to the exact verified hostname rather than applying it through the shared request function. 5. Document the compatibility requirement, emit a clear security warning, and establish a deadline for removing the exception. 6. Retain normal certificate and hostname verification, and consider enforcing a modern minimum TLS version such as TLS 1.2. 7. Add automated transport tests confirming that all configured endpoints work with secure renegotiation requirements and default TLS settings.