T09 · Insecure Skill Coding Practices
Error
- Location
dashboard/server.py:151- Finding
Network-Exposed Dashboard Uses a Bearer Token in Cleartext URLs
- Content
View full analysis
:{args.port}/?token={TOKEN}") print(f"\n Token: {TOKEN}") print(f"\n{'=' * 50}\n") app.run(host="0.0.0.0", port=args.port, threaded=True) ``` ```javascript const state = { tasks: [], agents: [], selectedTask: null, token: new URLSearchParams(location.search).get('token'), sseRetries: 0, eventSource: null, effectsOn: localStorage.getItem('cc_effects') === 'true', matrixRaf: null, sheetFocusTrap: null, previousFocus: null, }; const api = { async get(endpoint) { const res = await fetch(`${endpoint}?token=${state.token}`); if (res.status === 401) throw new Error('Unauthorized'); if (!res.ok) throw new Error(`API error: ${res.status}`); return res.json(); }, async post(endpoint, body = {}) { const res = await fetch(`${endpoint}?token=${state.token}`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) }); if (res.status === 401) throw new Error('Unauthorized'); if (!res.ok) throw new Error(`API error: ${res.status}`); return res.json(); } }; ``` ```javascript const es = new EventSource(`/api/heartbeat?token=${state.token}`); ``` ### Technical Analysis The Flask server listens on `0.0.0.0`, making the dashboard reachable through every availab ...[truncated 2398 chars]- Remediation
View remediation