T09 · Insecure Skill Coding Practices
Error
- Location
env-example.txt:1- Finding
Site Administrator Token Is Transmitted Over Plaintext HTTP
- Content
View full analysis
dict: return {"Authorization": f"token {ADMIN_TOKEN}", "Content-Type": "application/json"} def api(method: str, path: str, *, json_body: dict | None = None, params: dict | None = None, ok: tuple[int, ...] = (200, 201, 204)): if not GITEA_URL: raise GiteaError("GITEA_URL is not configured") resp = requests.request( method, f"{GITEA_URL}/api/v1{path}", headers=headers(), json=json_body, params=params, timeout=30, ) ``` ### Technical Analysis The supplied example configuration points to a public IP address over unencrypted HTTP. The API client attaches `GITEA_ADMIN_TOKEN` to every request through the `Authorization` header without requiring HTTPS. HTTP does not provide confidentiality or server authentication. A network-positioned attacker can observe the token directly or modify API requests and responses. The credential is explicitly declared as an administrator token and is used by code capable of accessing administrative endpoints, creating repositories, and modifying repository contents. Because `setup.sh` copies `env-example.txt` to `.env` when no configuration exists, the insecure transport value can become the active default configuration. ### Attack Path 1. An operator runs `setup.sh`, which copies the example environment file to `.env`. 2. The operator populates `GITEA_ADMIN_TOKEN` without replacing the HTTP endpoint with HTTPS. 3. A scan or state-management operation invokes `gitea_api.api()`. 4. The ...[truncated 714 chars]- Remediation
View remediation