T09 · Insecure Skill Coding Practices
- Location
scripts/ip-lookup.sh:5- Finding
IP Lookup Requests and Responses Are Transmitted Over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ip-lookup.sh:5, 29-34
Vulnerability Type: Plaintext transmission of lookup data and unauthenticated API responses
Risk Level: MediumVulnerable Code
bash API_BASE="http://ip-api.com/json"bash # Query a single IP query_ip() { local ip=$1 local url="$API_BASE/$ip?fields=61439" # Call API local response=$(curl -s "$url")The documentation also recommends scheme-less API requests that ordinarily resolve to plaintext HTTP:
bash curl -s "ip-api.com/json/?fields=61439" curl -s "ip-api.com/json/8.8.8.8?fields=61439" curl -s "ip-api.com/json/8.8.8.8?fields=country,city"Technical Analysis
The script explicitly sets the API base URL to
http://ip-api.com/json. Consequently, the requested IP address and the API response travel without transport encryption or server authentication.Any party capable of observing or modifying traffic between the host and the API can read the queried address and alter the response. This includes an attacker on the same untrusted network, a compromised gateway, or another on-path network operator.
The script trusts the response and extracts fields using
grepandcut. It subsequently displays remote values usingecho -e. A forged response can therefore present fabricated country, organization, ISP, coordinate, or autonomous-system information. Becauseecho -einterprets escape sequences, specially crafted response content may also manipulate terminal output if an attacker supplies raw control sequences that match the script's parsing patterns.This does not establish arbitrary shell-command execution: the response values are not evaluated as shell syntax. The confirmed security consequences are loss of confidentiality and integrity for lookup traffic, deceptive output, and possible terminal-display manipulation.
Attack Path
- A user runs `scripts/ip-l ...[truncated 1578 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace the plaintext service with an API endpoint that supports HTTPS. If the selected free service does not provide HTTPS, use its HTTPS-capable paid endpoint or a different trusted provider.
-
Explicitly require HTTPS rather than relying on redirects or scheme inference:
bash API_BASE="https://trusted-api.example/json" -
Harden
curlso network and HTTP failures are visible and insecure protocol fallback is prohibited:bash response=$(curl \ --fail \ --silent \ --show-error \ --proto '=https' \ --tlsv1.2 \ --connect-timeout 10 \ --max-time 20 \ "$url") || { printf 'Lookup request failed.\n' >&2 return 1 } -
Do not disable certificate validation. Avoid options such as
curl --insecure, and use the operating system's maintained CA trust store. -
Validate each argument as an IPv4 or IPv6 address before constructing the request. Reject control characters, URL delimiters, and arbitrary path or query components.
-
Use a proper JSON parser, such as
jq, rather than regular expressions. Require valid JSON, verify thatstatusissuccess, and validate field types and expected lengths. -
Print all API-controlled strings literally with
printfinstead ofecho -e:bash printf '%s\n' "$country"Strip terminal control characters from remote values before displaying them in an interactive terminal.
-
Update
SKILL.mdandreferences/fields.mdso every documented example uses the same HTTPS-only endpoint and security options. -
Clearly disclose that submitted IP addresses are transmitted to a third-party geolocation provider and avoid sending sensitive investigation targets without user approval.
-