T09 · Insecure Skill Coding Practices
- Location
config.js:5- Finding
Plaintext HTTP Login Endpoint Exposes Authentication Traffic
- Content
View full analysis
Vulnerability Details
File Location:
config.js:5
Vulnerability Type: Plaintext transmission of authentication and session data
Risk Level: HighVulnerable Code:
js loginUrl: 'http://ehis-unity-admin-afweb.psic.com.cn/user/login',Technical Analysis
The configured login endpoint uses HTTP rather than HTTPS. HTTP does not provide transport encryption, server authentication, or message integrity. If the intended browser automation submits credentials or session information to this endpoint, a network-positioned attacker could observe or modify that traffic.
The reviewed artifact does not contain the referenced runtime entry point,
index.js, so actual transmission of credentials cannot be confirmed. Nevertheless, using this configuration in the advertised login workflow would expose authentication traffic to interception.Attack Path
- An operator runs the intended automated review workflow on a network controlled or observable by an attacker.
- The workflow connects to the configured
http://login endpoint. - The attacker intercepts the unencrypted request or modifies the server response.
- If credentials, cookies, or tokens are transmitted, the attacker captures them or injects content into the session.
- The attacker reuses captured authentication material to access review tasks, subject to the privileges associated with the compromised account.
Impact Assessment
Successful exploitation could disclose account credentials, authentication cookies, or claim-review traffic. The attacker could potentially access or manipulate insurance review tasks with the compromised user's privileges. The precise scope cannot be established because the executable implementation and authorization model are absent from the artifact.
- Remediation
View remediation
Remediation Suggestions
- Replace the endpoint with an HTTPS URL backed by a valid, trusted certificate.
- Reject TLS certificate errors rather than disabling certificate validation.
- Prevent redirects from HTTPS endpoints to HTTP.
- Add a startup validation that refuses authentication against non-HTTPS URLs.
- Avoid placing credentials in URLs or logs, and use short-lived session tokens where supported.
- Confirm that all subsequent task-review requests also use authenticated HTTPS connections.