T09 · Insecure Skill Coding Practices
- Location
scripts/lib/config.js:16- Finding
SMTP STARTTLS Is Not Enforced for Gmail and Naver Connections
- Content
View full analysis
Vulnerability Details
File Location:
scripts/lib/config.js:16-22,scripts/lib/config.js:35-41, andscripts/lib/smtp-client.js:9-11
Vulnerability Type: Opportunistic TLS permits a potential SMTP downgrade
Risk Level: MediumVulnerable Code
js // scripts/lib/config.js:16-22 smtp: { host: process.env.GMAIL_SMTP_HOST || 'smtp.gmail.com', port: parseInt(process.env.GMAIL_SMTP_PORT) || 587, secure: false, // STARTTLS auth: { user: process.env.GMAIL_USER, pass: process.env.GMAIL_PASS } }js // scripts/lib/config.js:35-41 smtp: { host: process.env.NAVER_SMTP_HOST || 'smtp.naver.com', port: parseInt(process.env.NAVER_SMTP_PORT) || 587, secure: false, // STARTTLS auth: { user: process.env.NAVER_USER, pass: process.env.NAVER_PASS } }js // scripts/lib/smtp-client.js:9-11 async connect() { this.transporter = nodemailer.createTransport(this.config); await this.transporter.verify(); }Technical Analysis
Gmail and Naver use SMTP port 587 with
secure: false, which is the expected initial configuration for a STARTTLS connection. However, the Nodemailer transport does not setrequireTLS: true.Without
requireTLS, encryption is opportunistic rather than mandatory. If the SMTP server does not advertise STARTTLS—whether because of a malicious server, DNS or host redirection, or an on-path STARTTLS-stripping attack—the client may continue without guaranteeing that the connection has been upgraded before authentication.The same transport contains the email username and password. Consequently, failure to enforce TLS can expose authentication data and outgoing message content if the connection is downgraded or directed to an untrusted endpoint. The risk is increased because the SMTP host can be overridden through environment variables.
Attack Path
- A victim configures a Gmail or Naver account an ...[truncated 1209 chars]
- Remediation
View remediation
Remediation Suggestions
-
Require STARTTLS for all port 587 transports:
js smtp: { host: process.env.GMAIL_SMTP_HOST || 'smtp.gmail.com', port: parseInt(process.env.GMAIL_SMTP_PORT) || 587, secure: false, requireTLS: true, tls: { rejectUnauthorized: true, minVersion: 'TLSv1.2' }, auth: { user: process.env.GMAIL_USER, pass: process.env.GMAIL_PASS } } -
Apply the same configuration to the Naver SMTP transport.
-
Reject any authenticated SMTP configuration that uses neither direct TLS nor mandatory STARTTLS.
-
Validate overridden SMTP hosts against an explicit allowlist unless custom mail servers are an intentional supported feature.
-
Prefer provider-specific application passwords or narrowly scoped tokens instead of primary account passwords.
-
Add integration tests confirming that connection establishment fails when STARTTLS is unavailable or certificate validation fails.
-