T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/auth.py:75
- Finding
- Gateway credentials and SMS data may be transmitted over plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/auth.py:75-88`, `scripts/auth.py:103-121`, `SKILL.md:23`, `README.md:39`, `env.example.txt:1` **Vulnerability Type**: Transmission of sensitive information over an unencrypted channel **Risk Level**: High ### Vulnerable Code ```python base_url, username, password = _get_config() creds = base64.b64encode(f"{username}:{password}".encode()).decode() req = urllib.request.Request( f"{base_url}/auth/token", data=json.dumps({'ttl': 3600, 'scopes': ['messages:send', 'messages:read']}).encode(), headers={ 'Authorization': f'Basic {creds}', 'Content-Type': 'application/json' }, method='POST' ) try: with urllib.request.urlopen(req, timeout=10) as resp: ``` Subsequent authenticated API requests use the same configurable base URL: ```python headers = { 'Authorization': f'Bearer {token}', 'Accept': 'application/json' } body = None if data is not None: body = json.dumps(data).encode() headers['Content-Type'] = 'application/json' req = urllib.request.Request( f"{base_url}{path}", data=body, headers=headers, method=method ) with urllib.request.urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) ``` The supplied configuration and documentation encourage plaintext HTTP: ```text SMS_GATE_URL=http://192.168.50.69:8080 ``` ### Technical Analysis The Base64 operation is normal HTTP Basic Authentication encoding. It does not print or otherwise expose the credentials to standard output, and it is necessary for the gateway's documented authentication flow. It is therefore not, by itself, a covert exfiltration channel. However, Base64 provides no confidentiality. When `SMS_GATE_URL` uses `http://`, the Basic Authorization header containing the username and password is sent without transport encryption. Bearer tokens, SMS destination numbers, message content, message history, and webhook management requests are also s ...[truncated 1474 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require `https://` for `SMS_GATE_URL` by default. 2. Permit plaintext HTTP only for loopback addresses or through an explicit, prominently documented insecure-development override. 3. Reject unsupported schemes and validate the parsed host before making requests. 4. Use a properly validated TLS certificate for gateway connections. Do not disable certificate verification. 5. For gateways that cannot provide TLS directly, document a trusted TLS reverse proxy, VPN, or authenticated tunnel. 6. Warn users that a local network alone does not provide confidentiality against compromised peers, access points, or routers. 7. Consider using separate, narrowly scoped credentials and short-lived tokens so compromise does not grant broader gateway administration rights. ]]>