T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/setup_webhook.py:139
- Finding
- Unauthenticated webhook test server exposes complete email payloads<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup_webhook.py:139-174` **Vulnerability Type**: Unauthenticated network endpoint and plaintext sensitive-data logging **Risk Level**: High ### Vulnerable Code ```python app = Flask(__name__) @app.route('/') def home(): return """ <h1>AgentMail Webhook Test Server</h1> <p>✅ Server is running</p> <p>Webhook endpoint: <code>POST /webhook</code></p> <p>Check console output for incoming webhooks.</p> """ @app.route('/webhook', methods=['POST']) def webhook(): payload = request.json print("\n🪝 Webhook received:") print(f" Event: {payload.get('event_type')}") print(f" ID: {payload.get('event_id')}") if payload.get('event_type') == 'message.received': message = payload.get('message', {}) print(f" From: {message.get('from', [{}])[0].get('email')}") print(f" Subject: {message.get('subject')}") print(f" Preview: {message.get('preview', '')[:50]}...") print(f" Full payload: {json.dumps(payload, indent=2)}") print() return Response(status=200) print("🚀 Starting webhook test server on http://localhost:3000") print("📡 Webhook endpoint: http://localhost:3000/webhook") print("\n💡 For external access, use ngrok:") print(" ngrok http 3000") try: app.run(host='0.0.0.0', port=3000, debug=False) ``` ### Technical Analysis The test receiver accepts POST requests without verifying an AgentMail webhook signature, shared secret, or other authentication credential. It binds to `0.0.0.0`, making the endpoint reachable through every available network interface, and the script explicitly suggests exposing it through ngrok. The handler also serializes the complete webhook payload to standard output. AgentMail message events can include sender and recipient addresses, subject lines, message bodies, thread metadata, attachment metadata, and other potentially sensitive information. In environments where standar ...[truncated 1953 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bind the development server to `127.0.0.1` by default rather than `0.0.0.0`. 2. Require an explicit option such as `--public-listen` before listening on external interfaces. 3. Verify the AgentMail webhook signature against the raw request body before parsing or processing the payload. 4. Reject requests with missing signatures, invalid signatures, unsupported content types, malformed JSON, or oversized bodies. 5. Store the webhook secret in an environment variable or secret manager and fail closed when it is absent. 6. Avoid logging complete payloads. Log only an event identifier, event type, and a redacted inbox identifier. 7. Redact sender addresses, recipients, subjects, bodies, attachment metadata, authorization values, and other sensitive fields. 8. Add request-size limits and rate limiting to reduce denial-of-service and log-flooding risks. 9. Display a prominent warning before enabling ngrok or any other public tunnel. 10. Keep test and production receivers separate so development defaults cannot be copied into production accidentally. ]]>