T09 · Insecure Skill Coding Practices
Error
- Location
- references/examples.md:615
- Finding
- Tableau credentials can be transmitted to a caller-controlled endpoint<![CDATA[ ## Vulnerability Details **File Location**: `references/examples.md:615-634` **Vulnerability Type**: Unrestricted credential transmission **Risk Level**: High ### Vulnerable Code ```python def __init__(self, tableau_server_url, username, password): self.server_url = tableau_server_url self.username = username self.password = password self.auth_token = None self.site_id = None def authenticate(self): """Authenticate with Tableau Server""" auth_url = f"{self.server_url}/api/3.10/auth/signin" payload = { 'credentials': { 'name': self.username, 'password': self.password, 'site': {'contentUrl': ''} } } response = requests.post(auth_url, json=payload) ``` ### Technical Analysis The destination used to transmit the Tableau username and password is constructed directly from the caller-supplied `tableau_server_url`. The example does not require HTTPS, verify that the hostname belongs to an approved Tableau deployment, or explicitly prevent redirects. Authentication with Tableau is consistent with the Skill's BI-refresh functionality. However, allowing credentials to be sent to an unrestricted destination exceeds minimum privilege. A malicious or accidentally misconfigured URL could receive the supplied credentials. A plain HTTP URL could also expose them to network interception. The `requests` library verifies TLS certificates by default for HTTPS destinations, but that protection does not address a malicious yet valid HTTPS host, an explicitly supplied HTTP URL, or credential forwarding caused by unsafe destination configuration. ### Attack Path 1. An attacker influences the `tableau_server_url` configuration, deployment parameters, or copied implementation. 2. The victim supplies valid Tableau credentials and invokes `authenticate()`. 3. The code appends `/api/3.10/auth/signin` to the attacker-controlled URL. 4. `requests.post()` sends the username and passw ...[truncated 511 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Require an `https://` URL and reject all other schemes. - Parse the URL and compare its normalized hostname and port against an explicit allowlist. - Prevent authentication requests from following redirects, or validate every redirect destination before forwarding sensitive data. - Prefer a narrowly scoped Tableau personal access token or equivalent service credential over an interactive account password. - Retrieve credentials from a managed secret store or protected environment variables. - Use a dedicated least-privileged service account restricted to the required data-source refresh operations. - Do not log request bodies, authentication headers, passwords, or returned tokens. - Add tests confirming that HTTP URLs, unapproved hosts, embedded URL credentials, and unexpected redirects are rejected. ]]>