T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/find_emails.py:54
- Finding
- TLS Certificate Validation Disabled for All HTTPS Requests<![CDATA[ ## Vulnerability Details **File Location**: `scripts/find_emails.py`, lines 54–59 **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code ```python def fetch_page(url, timeout=10): """Fetch a URL and return its text content, or None on failure.""" try: req = Request(url, headers=HEADERS) ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE with urlopen(req, timeout=timeout, context=ctx) as resp: ``` ### Technical Analysis The `fetch_page()` function explicitly disables both TLS hostname verification and certificate-chain validation. Consequently, every HTTPS connection made through this function accepts expired, self-signed, incorrectly issued, or attacker-controlled certificates. This affects connections to: - Websites being searched for email addresses - Google search endpoints - Hunter.io endpoints - Redirect destinations reached by `urlopen()` Although the network requests support the Skill's declared email-finding functionality, disabling certificate validation is not necessary for that functionality and exceeds safe minimum network privileges. It removes the server-authentication property normally provided by HTTPS. An attacker capable of intercepting network traffic can impersonate any requested HTTPS server and return manipulated content. Because the response is searched for addresses matching the target domain, the attacker can inject fabricated email addresses into the result. Those addresses may subsequently be submitted to the target MX server through SMTP verification. ### Attack Path 1. A user runs the Skill on a network controlled or monitored by an attacker. 2. The Skill requests a target website, Google, or Hunter.io over HTTPS. 3. The attacker intercepts the TLS connection and presents an attacker-controlled certificate. 4. The certificate is accepted because hostname and certificate validation ar ...[truncated 906 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Remove the insecure TLS context and rely on the platform's default certificate validation: ```python def fetch_page(url, timeout=10): try: req = Request(url, headers=HEADERS) with urlopen(req, timeout=timeout) as resp: data = resp.read(500_000) charset = resp.headers.get_content_charset() or 'utf-8' return data.decode(charset, errors='replace') except Exception: return None ``` Additional hardening should include: 1. Do not expose an option that disables certificate validation. 2. Use a trusted CA bundle if a custom certificate store is required. 3. Validate HTTPS redirects before following them. 4. Log TLS failures without silently retrying through an insecure connection. 5. Consider returning structured error information instead of catching every exception without distinction. ]]>