T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/sigaa_login.sh:57
- Finding
- Credentials Can Be Submitted to an Unvalidated or Cleartext Authentication Host<![CDATA[ ## Vulnerability Details **File Location**: `scripts/sigaa_login.sh`, lines 57–80 and 95–108 **Vulnerability Type**: Unvalidated credential destination **Risk Level**: High ### Vulnerable Code ```bash INITIAL_URL=$(curl -s -o /dev/null -w "%{url_effective}" -L \ -c "$SIGAA_COOKIE_FILE" -b "$SIGAA_COOKIE_FILE" \ -A "$AGENT" \ "${SIGAA_URL}/sigaa/verTelaLogin.do" 2>/dev/null) if echo "$INITIAL_URL" | grep -qiE "autenticacao|sso-server|/cas"; then LOGIN_PAGE=$(curl -s \ -c "$SIGAA_COOKIE_FILE" -b "$SIGAA_COOKIE_FILE" \ -A "$AGENT" "$INITIAL_URL") ACTION_PATH=$(echo "$LOGIN_PAGE" | grep -oP 'action="[^"]*"' | head -1 | sed 's/action="//;s/"//') LT=$(echo "$LOGIN_PAGE" | grep 'name="lt"' | grep -oP 'value="[^"]*"' | sed 's/value="//;s/"//') EXEC=$(echo "$LOGIN_PAGE" | grep 'name="execution"' | grep -oP 'value="[^"]*"' | sed 's/value="//;s/"//') CAS_BASE=$(echo "$INITIAL_URL" | grep -oP 'https?://[^/]+') FULL_ACTION="${CAS_BASE}${ACTION_PATH}" RESULT=$(curl -s -L \ -c "$SIGAA_COOKIE_FILE" -b "$SIGAA_COOKIE_FILE" \ -A "$AGENT" \ -X POST "$FULL_ACTION" \ --data-urlencode "username=${SIGAA_USER}" \ --data-urlencode "password=${SIGAA_PASSWORD}" \ ``` The direct-login branch similarly submits credentials to the unchecked `SIGAA_URL`: ```bash LOGIN_PAGE=$(curl -s \ -c "$SIGAA_COOKIE_FILE" -b "$SIGAA_COOKIE_FILE" \ -A "$AGENT" \ "${SIGAA_URL}/sigaa/verTelaLogin.do") RESULT=$(curl -s -L \ -c "$SIGAA_COOKIE_FILE" -b "$SIGAA_COOKIE_FILE" \ -A "$AGENT" \ -X POST "${SIGAA_URL}/sigaa/logar.do" \ -d "dispatch=logOn" \ --data-urlencode "user.login=${SIGAA_USER}" \ --data-urlencode "user.senha=${SIGAA_PASSWORD}" \ ``` ### Technical Analysis The script accepts `SIGAA_URL` without requiring HTTPS, validating its hostname, or checking it against the documented institution list. In the CAS branch, it follows redirects and treats a final URL as CAS solely when its text contains `autenticacao`, `sso-ser ...[truncated 2242 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require `SIGAA_URL` to use `https://`; reject HTTP and malformed URLs before making any request. 2. Normalize the URL and reject embedded credentials, fragments, unexpected ports, and ambiguous host representations. 3. Maintain an explicit mapping from each supported SIGAA hostname to its authorized CAS hostname. 4. For unlisted institutions, require explicit user approval of both normalized hostnames before credentials are submitted. 5. Do not infer trust from path or hostname substrings such as `/cas` or `autenticacao`. 6. Validate that the CAS form action resolves to the approved CAS origin. Reject protocol-relative, cross-origin, malformed, or cleartext actions. 7. Process redirects one at a time and validate every `Location` destination against the approved SIGAA/CAS origins. 8. Set appropriate connection and request timeouts and use `curl --fail-with-body --show-error` so transport failures are not mistaken for successful authentication. 9. Document the exact credential recipients before login and display them for user confirmation when an unknown institution is configured. ]]>