T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/searxng.py:57
- Finding
- TLS Certificate Verification Disabled for All SearXNG Connections## Vulnerability Details **File Location**: `scripts/searxng.py:57-63` **Additional Location**: `scripts/searxng.py:20` **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code ```python # Suppress SSL warnings for local self-signed certificates warnings.filterwarnings('ignore', message='Unverified HTTPS request') ``` ```python # Disable SSL verification for local self-signed certs response = httpx.get( f"{SEARXNG_URL}/search", params=params, timeout=30, verify=False # For local self-signed certs ) ``` ### Technical Analysis The HTTP client explicitly sets `verify=False`, disabling TLS certificate-chain and hostname validation for every configured SearXNG endpoint. The behavior is not restricted to localhost or an explicitly approved self-signed certificate. Consequently, possession of a valid certificate is not required to impersonate a remote HTTPS SearXNG service. The warning filter also suppresses indications that an unverified HTTPS connection is being used. HTTPS encryption without certificate authentication does not protect against an active man-in-the-middle attacker. ### Attack Path 1. A user configures `SEARXNG_URL` with an HTTPS endpoint. 2. An attacker gains a position capable of manipulating traffic, such as a hostile wireless network, compromised DNS resolver, proxy, or gateway. 3. The attacker redirects the connection to an impersonated SearXNG service presenting an invalid or attacker-controlled certificate. 4. Because `verify=False` is used, the client accepts the certificate without validating its trust chain or hostname. 5. The attacker observes submitted search queries and returns manipulated search results, URLs, titles, or snippets. 6. A user or downstream agent may act on the attacker-controlled results. ### Impact Assessment The attacker can compromise the confidentiality and integrity of data exchanged with the ...[truncated 391 chars]
- Remediation
- ## Remediation Suggestions - Remove `verify=False` and use certificate verification by default: ```python response = httpx.get( f"{SEARXNG_URL}/search", params=params, timeout=30, verify=True, ) ``` - Support private certificate authorities through an explicit CA bundle path, such as `SEARXNG_CA_BUNDLE`, and pass that trusted bundle to `httpx`. - If insecure TLS support is unavoidable, require an explicitly named opt-in setting such as `SEARXNG_INSECURE_TLS=true`; never enable it by default. - Emit a prominent warning whenever insecure mode is enabled rather than suppressing TLS warnings. - Consider restricting insecure mode to loopback addresses and reject its use with non-local hosts. - Add automated tests confirming that invalid certificates and hostname mismatches are rejected by default.