T09 · Insecure Skill Coding Practices
Error
- Location
- main.py:146
- Finding
- Mailbox Credentials Can Be Transmitted to Configuration-Controlled Servers<![CDATA[ ## Vulnerability Details **File Location**: `main.py:146-154` **Additional Locations**: `main.py:235-238`, `main.py:333-357`, `main.py:469-481`, `main.py:497-498`, `main.py:566-567`, `main.py:641-642`, `main.py:719-720` **Vulnerability Type**: Unrestricted credential destination **Risk Level**: High ### Vulnerable Code ```python print(f"\n📧 测试 IMAP 连接...") print(f" 服务器：{config['imap_server']}:{config['imap_port']}") # 创建 SSL 连接 mail = imaplib.IMAP4_SSL(config['imap_server'], config['imap_port']) # 登录 print(f" 登录：{config['email']}") mail.login(config['email'], config['password']) ``` The SMTP path similarly trusts the configured server and resolves it to an IP address: ```python import socket smtp_host = config['smtp_server'] smtp_port = config['smtp_port'] # 解析 IPv4 地址 addr_info = socket.getaddrinfo( smtp_host, smtp_port, socket.AF_INET, socket.SOCK_STREAM ) ipv4_addr = addr_info[0][4][0] print(f" 使用 IPv4 地址：{ipv4_addr}") # 创建 SMTP 连接（强制 IPv4） server = smtplib.SMTP_SSL(ipv4_addr, smtp_port, timeout=30) server.ehlo() server.login(config['email'], config['password']) server.sendmail(config['email'], [args.to], msg.as_string()) server.quit() ``` ### Technical Analysis The Skill necessarily sends a mailbox address and authorization code to IMAP and SMTP servers because authentication is intrinsic to its declared email-management functionality. However, the destination host and port are taken directly from the editable configuration file without an allowlist or destination validation. This conflicts with the package metadata and security documentation, which state that the Skill connects only to `imap.163.com:993` and `smtp.163.com:465`. The implementation permits arbitrary hosts and ports. The SMTP implementation also resolves the configured hostname and constructs the TLS connection using the resulting IP address rather than the intended hostname. This prevents the TLS layer from naturally associating the connection with the confi ...[truncated 1604 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Enforce exact destination allowlists before any connection: - IMAP: `imap.163.com` on port `993`. - SMTP: `smtp.163.com` on port `465`. 2. Reject IP literals, alternate ports, Unicode hostname ambiguities, and unexpected server names for this 163.com-specific Skill. 3. Connect to SMTP using the hostname rather than its resolved IP: ```python context = ssl.create_default_context() server = smtplib.SMTP_SSL( "smtp.163.com", 465, timeout=30, context=context ) ``` 4. Create and pass an explicit verified TLS context to both SMTP and IMAP connections. 5. If custom mail servers are intentionally supported, document that broader functionality and require explicit informed opt-in rather than silently trusting configuration values. 6. Validate the configuration before loading credentials into a connection and terminate with a clear error if the destination is not approved. 7. Add automated tests proving that unauthorized hosts, ports, and IP-address destinations are rejected. ]]>