T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/ambari_api.py:35
- Finding
- TLS Certificate Verification Disabled by Default<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ambari_api.py:14, 35-38, 53-60` **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code ```python urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) ``` ```python def __init__(self, base_url, username, password, verify_ssl=False): self.base_url = base_url.rstrip('/') self.auth = HTTPBasicAuth(username, password) self.verify_ssl = verify_ssl ``` ```python response = self.session.request( method=method, url=url, auth=self.auth, json=data, params=params, verify=self.verify_ssl ) ``` ### Technical Analysis The client disables TLS certificate verification by default through `verify_ssl=False` and suppresses the corresponding `InsecureRequestWarning`. Every client created by the command-line interface uses this insecure default because no CLI or configuration option is provided to enable certificate verification. Consequently, the client does not verify that it is communicating with the intended Ambari server. HTTP Basic Authentication credentials are transmitted with each request and are protected only by the unverified TLS connection. An attacker able to intercept network traffic can present an arbitrary certificate without causing the connection to fail. The warning suppression further reduces the likelihood that an operator will notice the insecure connection. ### Attack Path 1. An operator configures an HTTPS Ambari endpoint and invokes a cluster-management command. 2. An attacker obtains a network interception position, such as through a compromised gateway, malicious proxy, DNS poisoning, or hostile wireless network. 3. The attacker redirects or intercepts the connection and presents an attacker-controlled TLS certificate. 4. The client accepts the certificate because `verify=False` is used. 5. The client sends the Ambari username and password using HTTP Basic Authentication. 6. The attacker cap ...[truncated 650 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Change the constructor default to `verify_ssl=True`. 2. Remove the global suppression of `InsecureRequestWarning`. 3. Add support for a trusted CA bundle through a CLI option or configuration field. 4. Permit insecure TLS only through an explicit option such as `--insecure`, accompanied by a prominent warning. 5. Reject plain HTTP endpoints by default, especially when privileged credentials are used. 6. Consider implementing the constructor as follows: ```python def __init__(self, base_url, username, password, verify_ssl=True): self.base_url = base_url.rstrip('/') self.auth = HTTPBasicAuth(username, password) self.verify_ssl = verify_ssl ``` 7. Add automated tests confirming that self-signed or untrusted certificates are rejected unless insecure mode is explicitly requested. ]]>