T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bark-notify.py:191- Finding
Credentials and notification content can be transmitted over cleartext HTTP
- Content
View full analysis
dict[str, Any]: payload: dict[str, Any] = { "device_key": key, "title": title, "body": " ".join(body), "group": group, } for name in ("sound", "icon", "url", "copy", "level", "badge"): value = getattr(args, name) if value is not None: payload[name] = value if "icon" not in payload and icon: payload["icon"] = icon return payload ``` ```python server = (args.server or os.environ.get("BARK_SERVER") or cfg.get("BARK_SERVER") or DEFAULT_SERVER).rstrip("/") ``` ```python result = request_json(f"{server}/push", payload) ``` ### Technical Analysis The Bark server can be selected through a command-line argument, an environment variable, or the local configuration file. The application does not parse or validate the selected URL before appending `/push` and transmitting the request. The request payload contains the Bark `device_key` as well as the notification title, body, group, and optional metadata. Although sending these values to a Bark server is necessary for the declared notification functionality, permitting an arbitrary `http://` destination exceeds the minimum secure network privileges needed for normal use. If a remote cleartext HTTP server is selected, TLS does not protect the request. A network-positioned attacker can observe or alter the payload. A maliciously modified environment or configuration can also redirect the payload to an attacker-controlled endpoint. ### Attack Path 1. An attacker influences `BARK_SERVER`, modifies the local configuration ...[truncated 1030 chars]- Remediation
View remediation