T09 · Insecure Skill Coding Practices
Warning
- Location
- main.py:73
- Finding
- Weather API Communication Uses Unencrypted HTTP## Vulnerability Details **File Location**: `main.py`, lines 73–74 **Vulnerability Type**: Plaintext external API communication **Risk Level**: Medium ### Vulnerable Code ```python url = f"http://wttr.in/{city}?format=j1" response = requests.get(url, timeout=5) ``` ### Technical Analysis The skill retrieves weather information over unencrypted HTTP. HTTP provides neither transport confidentiality nor server authenticity nor response integrity. An attacker with a network interception position could observe the requested city or modify the API response in transit. The returned body is subsequently parsed and trusted without validating the HTTP status, content type, response size, or expected response schema. Values from the response are incorporated into the user-facing reply. Although the code does not execute those values as code, a forged or malformed response could produce attacker-controlled output or disrupt the skill. ### Attack Path 1. A user invokes the skill and requests weather for a supported city. 2. The skill sends a plaintext HTTP request to `wttr.in`. 3. An attacker with control over or visibility into the network path intercepts the request. 4. The attacker returns a forged, oversized, or malformed JSON response. 5. If the forged response follows the expected structure, attacker-controlled weather values are rendered in the skill reply. If it is malformed, parsing fails and the skill returns no weather data. ### Impact Assessment Exploitation requires a network-level interception position, such as control of an untrusted access point, proxy, gateway, or another relevant segment of the request path. The issue does not grant local code execution, filesystem access, elevated privileges, persistence, or credential access. The primary impacts are loss of response integrity, disclosure of the requested city to network observers, misleading user-facing weather information, and potential availability degra ...[truncated 56 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the endpoint with HTTPS: ```python url = f"https://wttr.in/{city}?format=j1" ``` 2. Require successful HTTP status codes before parsing: ```python response.raise_for_status() ``` 3. Validate that the response content type is JSON. 4. Parse with `response.json()` and verify the expected object structure and field types before use. 5. Enforce an acceptable response-size limit to reduce resource-exhaustion risk. 6. Retain explicit connection and read timeouts, preferably as a timeout tuple. 7. Handle specific `requests` and JSON exceptions rather than suppressing all exceptions with a bare `except`.