T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mantrae_api.py:42- Finding
Mantrae credentials can be transmitted over an unauthenticated or plaintext connection
- Content
View full analysis
dict: parsed = urllib.parse.urlparse(base_url) url_base = base_url.rstrip("/") host_header = None if connect_ip: netloc = connect_ip if parsed.port: netloc = f"{connect_ip}:{parsed.port}" url_base = urllib.parse.urlunparse( (parsed.scheme, netloc, parsed.path.rstrip("/"), "", "", "") ) host_header = parsed.netloc url = url_base + path body = json.dumps(payload).encode("utf-8") headers = { "Accept": "application/json", "Content-Type": "application/json", "Connect-Protocol-Version": "1", } if token: headers["Authorization"] = f"Bearer {token}" if host_header: headers["Host"] = host_header req = urllib.request.Request(url, data=body, headers=headers, method="POST") context = ssl._create_unverified_context() if insecure else None with urllib.request.urlopen(req, timeout=timeout, context=context) as response: return json.loads(response.read()) ``` ```python parser.add_argument("--insecure", action="store_true", help="Skip TLS verification") ``` The script also accepts a caller-controlled base URL and defines a plaintext HTTP default: ```python DEFAULT_BASE_URL = "http://localhost:3000" ``` ### Technical Analysis The Mantrae helper sends either a bearer token in the `Authorization` header or login credentials in a JSON request body. Although sending authentication material to the configured Mantrae service is necessary for the declared functionality, the transport protections are insuff ...[truncated 2405 chars]- Remediation
View remediation