T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/ip-lookup.sh:5
- Finding
- IP Lookup Requests and Responses Are Transmitted Over Plaintext HTTP## Vulnerability Details **File Location**: `scripts/ip-lookup.sh:5, 29-34` **Vulnerability Type**: Plaintext transmission of lookup data and unauthenticated API responses **Risk Level**: Medium ### Vulnerable Code ```bash API_BASE="http://ip-api.com/json" ``` ```bash # Query a single IP query_ip() { local ip=$1 local url="$API_BASE/$ip?fields=61439" # Call API local response=$(curl -s "$url") ``` The documentation also recommends scheme-less API requests that ordinarily resolve to plaintext HTTP: ```bash curl -s "ip-api.com/json/?fields=61439" curl -s "ip-api.com/json/8.8.8.8?fields=61439" curl -s "ip-api.com/json/8.8.8.8?fields=country,city" ``` ### Technical Analysis The script explicitly sets the API base URL to `http://ip-api.com/json`. Consequently, the requested IP address and the API response travel without transport encryption or server authentication. Any party capable of observing or modifying traffic between the host and the API can read the queried address and alter the response. This includes an attacker on the same untrusted network, a compromised gateway, or another on-path network operator. The script trusts the response and extracts fields using `grep` and `cut`. It subsequently displays remote values using `echo -e`. A forged response can therefore present fabricated country, organization, ISP, coordinate, or autonomous-system information. Because `echo -e` interprets escape sequences, specially crafted response content may also manipulate terminal output if an attacker supplies raw control sequences that match the script's parsing patterns. This does not establish arbitrary shell-command execution: the response values are not evaluated as shell syntax. The confirmed security consequences are loss of confidentiality and integrity for lookup traffic, deceptive output, and possible terminal-display manipulation. ### Attack Path 1. A user runs `scripts/ip-l ...[truncated 1578 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the plaintext service with an API endpoint that supports HTTPS. If the selected free service does not provide HTTPS, use its HTTPS-capable paid endpoint or a different trusted provider. 2. Explicitly require HTTPS rather than relying on redirects or scheme inference: ```bash API_BASE="https://trusted-api.example/json" ``` 3. Harden `curl` so network and HTTP failures are visible and insecure protocol fallback is prohibited: ```bash response=$(curl \ --fail \ --silent \ --show-error \ --proto '=https' \ --tlsv1.2 \ --connect-timeout 10 \ --max-time 20 \ "$url") || { printf 'Lookup request failed.\n' >&2 return 1 } ``` 4. Do not disable certificate validation. Avoid options such as `curl --insecure`, and use the operating system's maintained CA trust store. 5. Validate each argument as an IPv4 or IPv6 address before constructing the request. Reject control characters, URL delimiters, and arbitrary path or query components. 6. Use a proper JSON parser, such as `jq`, rather than regular expressions. Require valid JSON, verify that `status` is `success`, and validate field types and expected lengths. 7. Print all API-controlled strings literally with `printf` instead of `echo -e`: ```bash printf '%s\n' "$country" ``` Strip terminal control characters from remote values before displaying them in an interactive terminal. 8. Update `SKILL.md` and `references/fields.md` so every documented example uses the same HTTPS-only endpoint and security options. 9. Clearly disclose that submitted IP addresses are transmitted to a third-party geolocation provider and avoid sending sensitive investigation targets without user approval.