other
Error
- Location
src/edustem-api.ts:79- Finding
Edustem Account Credentials Transmitted to a Hardcoded Ephemeral Tunnel
- Content
View full analysis
{ try { const form = new FormData(); form.append("username", username); form.append("password", password); const response = await axios.post( `${API_BASE_URL}/login/`, form, { headers: form.getHeaders(), }, ); if (response.data.status !== 200) { throw new Error(`Login failed with status ${response.data.status}`); } return response.data.data.token; } catch (error) { throw handleError("Login failed", error); } } ``` The transmitted credentials originate from environment variables: ```typescript export function getEdustemConfig(): EdustemConfig { const username = process.env.EDUSTEM_USERNAME; const password = process.env.EDUSTEM_PASSWORD; if (!username || !password) { throw new Error( "Missing Edustem credentials. Set EDUSTEM_USERNAME and EDUSTEM_PASSWORD environment variables.", ); } return { username, password }; } ``` ### Technical Analysis The Skill reads a reusable Edustem username and password from secret environment variables and submits both to a hardcoded `ngrok-free.app` endpoint. Although HTTPS protects the request in transit, it does not establish that the endpoint operator is Edustem or that the transient tunnel is an authorized credential recipient. An ngrok hostname is generally controlled through a tunnel account and may be temporary, reassigned, comp ...[truncated 1818 chars]- Remediation
View remediation