T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sigaa_login.sh:57- Finding
Credentials Can Be Submitted to an Unvalidated or Cleartext Authentication Host
- Content
View full analysis
/dev/null) if echo "$INITIAL_URL" | grep -qiE "autenticacao|sso-server|/cas"; then LOGIN_PAGE=$(curl -s \ -c "$SIGAA_COOKIE_FILE" -b "$SIGAA_COOKIE_FILE" \ -A "$AGENT" "$INITIAL_URL") ACTION_PATH=$(echo "$LOGIN_PAGE" | grep -oP 'action="[^"]*"' | head -1 | sed 's/action="//;s/"//') LT=$(echo "$LOGIN_PAGE" | grep 'name="lt"' | grep -oP 'value="[^"]*"' | sed 's/value="//;s/"//') EXEC=$(echo "$LOGIN_PAGE" | grep 'name="execution"' | grep -oP 'value="[^"]*"' | sed 's/value="//;s/"//') CAS_BASE=$(echo "$INITIAL_URL" | grep -oP 'https?://[^/]+') FULL_ACTION="${CAS_BASE}${ACTION_PATH}" RESULT=$(curl -s -L \ -c "$SIGAA_COOKIE_FILE" -b "$SIGAA_COOKIE_FILE" \ -A "$AGENT" \ -X POST "$FULL_ACTION" \ --data-urlencode "username=${SIGAA_USER}" \ --data-urlencode "password=${SIGAA_PASSWORD}" \ ``` The direct-login branch similarly submits credentials to the unchecked `SIGAA_URL`: ```bash LOGIN_PAGE=$(curl -s \ -c "$SIGAA_COOKIE_FILE" -b "$SIGAA_COOKIE_FILE" \ -A "$AGENT" \ "${SIGAA_URL}/sigaa/verTelaLogin.do") RESULT=$(curl -s -L \ -c "$SIGAA_COOKIE_FILE" -b "$SIGAA_COOKIE_FILE" \ -A "$AGENT" \ -X POST "${SIGAA_URL}/sigaa/logar.do" \ -d "dispatch=logOn" \ --data-urlencode "user.login=${SIGAA_USER}" \ --data-urlencode "user.senha=${SIGAA_PASSWORD}" \ ``` ### Technical Analysis The script accepts `SIGAA_URL` without requiring HTTPS, validating its hostname, or checking it against the documented institution list. In the CAS branch, it follows redirects and treats a final URL as CAS solely when its text contains `autenticacao`, `sso-ser ...[truncated 2242 chars]- Remediation
View remediation