T09 · Insecure Skill Coding Practices
- Location
sources.py:213- Finding
Berkeley Earth Data Is Retrieved Over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
sources.py:213-222
Vulnerability Type: Plaintext transport of externally sourced scientific data
Risk Level: MediumVulnerable Code
python region_lower = region.lower().replace(' ', '-') url = f"http://berkeleyearth.lbl.gov/regions/{region_lower}.txt" try: print(f"📊 正在获取 Berkeley Earth {region} 温度异常数据...") req = urllib.request.Request( url, headers={'User-Agent': 'OpenClaw-ENSO-Tracker/1.0'} ) with urllib.request.urlopen(req, timeout=10) as response: data = response.read().decode('utf-8')Technical Analysis
Historical temperature data is downloaded over unencrypted HTTP. HTTP provides neither server authentication nor response integrity, allowing an attacker with a privileged network position to intercept and modify the response.
The response is parsed as trusted temperature anomaly data and used directly to generate anomaly and ENSO correlation charts. There is no integrity check, response-size limit, strict schema validation, or plausible-range validation before the data influences the output.
Although the request does not transmit an API key or other credential, read-only data can still be security-relevant when its integrity affects analytical conclusions.
Attack Path
- A user runs the
anomalyorcorrelatecommand. - The Skill requests regional data from
http://berkeleyearth.lbl.gov/.... - An attacker controlling a network gateway, proxy, DNS path, or untrusted wireless network intercepts the plaintext request.
- The attacker returns forged or malformed temperature records.
- The parser accepts syntactically valid attacker-supplied numeric values.
- The Skill generates charts and analyses using the manipulated records.
Impact Assessment
The attacker does not gain local code execution or additional operating-system privileges through the demonstrated path. Howeve ...[truncated 334 chars]
- A user runs the
- Remediation
View remediation
Remediation Suggestions
- Replace the HTTP endpoint with an official HTTPS endpoint.
- Reject redirects that downgrade from HTTPS to HTTP and verify the final response URL.
- Limit the maximum response size before reading it into memory.
- Validate the content type and expected text encoding.
- Enforce a strict record schema and plausible ranges for years, months, and anomaly values.
- Where available, verify downloaded data using a publisher-provided checksum or signature.
- Fail clearly when authentic data cannot be obtained rather than silently substituting simulated data in analytical output.