T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/loxone_client.py:34
- Finding
- HTTP Basic Credentials Can Be Transmitted Over an Unencrypted Connection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/loxone_client.py:34-53` **Vulnerability Type**: Plaintext credential transmission **Risk Level**: High The configuration documented in `SETUP.md:39-44` explicitly permits `"use_https": false`. Under that configuration, the client sends a reversible Base64-encoded username and password over plaintext HTTP. ```python self.use_https = use_https self.protocol = "https" if use_https else "http" self.base_url = f"{self.protocol}://{self.host}" self.structure = None self.rooms = {} self.controls = {} # Create auth header auth_str = f"{username}:{password}" auth_bytes = auth_str.encode('utf-8') self.auth_header = base64.b64encode(auth_bytes).decode('utf-8') def _make_request(self, endpoint: str, method: str = "GET") -> requests.Response: url = f"{self.base_url}{endpoint}" headers = { 'Authorization': f'Basic {self.auth_header}' } try: response = requests.request( method, url, headers=headers, timeout=10, verify=self.use_https ) ``` The corresponding documented configuration is: ```json { "host": "192.168.0.222", "use_https": false } ``` ### Technical Analysis HTTP Basic authentication does not encrypt credentials. The `username:password` string is only Base64-encoded, which is trivially reversible. When `use_https` is false, both the Authorization header and subsequent smart-home API traffic are exposed to network observers. The use of `verify=self.use_https` does not compensate for this issue. With an HTTP URL, no TLS connection or certificate verification occurs at all. Network communication with the configured Loxone Miniserver is necessary for the declared functionality, so the behavior is not covert exfiltration. However, transmitting reusable credentials without encryption exceeds an acceptable minimum security baseline. ### Attack Path 1. A user configures a LAN Miniserver with `"use_ ...[truncated 1213 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require HTTPS for all requests carrying credentials. 2. Reject `use_https: false` by default rather than silently permitting Basic authentication over HTTP. 3. If legacy plaintext LAN access must remain available, require an explicit high-risk override such as `allow_insecure_http: true` and display a prominent warning. 4. Prefer short-lived token authentication over repeatedly sending reusable account credentials. 5. Recommend a dedicated least-privilege Loxone account restricted to only the controls required by the Skill. 6. Update `SETUP.md` to state clearly that Base64 is not encryption and that plaintext LAN authentication exposes credentials. 7. Where a Miniserver cannot support HTTPS directly, recommend a trusted TLS-terminating reverse proxy, VPN, or another authenticated encrypted tunnel. 8. Add automated tests that reject insecure transport whenever an Authorization header is present. ]]>