T09 · Insecure Skill Coding Practices
Error
- Location
scripts/analyze_cluster.py:37- Finding
TLS Certificate Verification Is Disabled by Default for Authenticated Cluster Connections
- Content
View full analysis
OpenSearch: """Create an OpenSearch client connection.""" parsed = url.rstrip("/") use_ssl = parsed.startswith("https") kwargs = { "hosts": [parsed], "use_ssl": use_ssl, "verify_certs": verify_ssl, "ssl_show_warn": False, "connection_class": RequestsHttpConnection, "timeout": 30, } if not no_auth and username and password: kwargs["http_auth"] = (username, password) return OpenSearch(**kwargs) ``` ```python parser.add_argument("--url", required=True, help="OpenSearch cluster URL (e.g., https://host:9200)") parser.add_argument("--username", "-u", help="Username for basic auth") parser.add_argument("--password", "-p", help="Password for basic auth") parser.add_argument("--no-auth", action="store_true", help="Connect without authentication") parser.add_argument("--verify-ssl", action="store_true", help="Verify SSL certificates (default: false)") ``` ### Technical Analysis The analyzer sends HTTP Basic Authentication credentials to a user-selected OpenSearch endpoint, but TLS certificate validation is disabled unless the user explicitly supplies `--verify-ssl`. Consequently, an HTTPS connection encrypts traffic without reliably authenticating the destination s ...[truncated 2040 chars]- Remediation
View remediation
OpenSearch: ``` 2. Replace `--verify-ssl` with an explicitly dangerous `--insecure` option. Require deliberate opt-in and print a prominent warning when it is used. 3. Reject non-HTTPS URLs whenever authentication is enabled: ```python if not no_auth and not parsed.startswith("https://"): raise ValueError("HTTPS is required when credentials are used") ``` 4. Remove `warnings.filterwarnings("ignore")` and set `ssl_show_warn=True`. 5. Support private certificate authorities through a `--ca-certs` option rather than advising users to disable verification. 6. Validate that the URL scheme is exactly `https` or `http`, reject embedded URL credentials, and document the expected endpoint. 7. Use a dedicated read-only OpenSearch principal with only the cluster-monitoring and index-metadata permissions required by the selected analysis action. 8. Add automated tests confirming that authenticated HTTP is rejected and that certificate verification is enabled unless an explicit insecure override is supplied. ]]>