T09 · Insecure Skill Coding Practices
- Location
scripts/send_message.py:67- Finding
Board Credentials and Message Content Transmitted over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/send_message.py, lines 67-100
Vulnerability Type: Plaintext transmission of credentials and sensitive message data
Risk Level: HighVulnerable Code
python # Handle hostname vs IP (simple check, user must provide scheme or we assume http) if ip.startswith("http"): url = f"{ip}/api" else: url = f"http://{ip}/api" # Build payload payload = {"MSG": args.message} if args.repeat is not None: payload["REP"] = args.repeat if args.buzzer is not None: payload["BUZ"] = args.buzzer if args.delay is not None: payload["DEL"] = args.delay if args.brightness is not None: payload["BRI"] = args.brightness if args.chirp is not None: payload["ALERTCHIRP"] = args.chirp data = json.dumps(payload).encode('utf-8') # Setup request req = urllib.request.Request(url, data=data, method='POST') req.add_header('Content-Type', 'application/json') # Basic Auth auth_str = f"{user}:{password}" b64_auth = base64.b64encode(auth_str.encode('utf-8')).decode('utf-8') req.add_header('Authorization', f"Basic {b64_auth}")Technical Analysis
The script sends the board username, password, and message through an HTTP request. Base64 encoding is required by HTTP Basic Authentication, but it provides no confidentiality and can be trivially decoded.
When the supplied destination does not begin with
http, the script explicitly constructs a plaintexthttp://URL. It also accepts a caller-controlled URL through--ipwithout restricting the destination to approved board addresses or requiring HTTPS. Consequently, credentials loaded from environment variables orboards.yamlcan be sent to a caller-selected endpoint.The network transmission itself is necessary for the Skill's declared message-board functionality. The use of plaintext HTTP and unrestricted destinations, however, does not follow least-trust principles and exposes more sensitive information ...[truncated 1234 chars]
- Remediation
View remediation
Remediation Suggestions
- Require HTTPS for authenticated connections and retain standard TLS certificate and hostname validation.
- Reject plaintext HTTP unless the user explicitly enables a documented legacy mode after receiving a security warning.
- Parse destinations with
urllib.parse.urlsplitand permit only approved schemes, hosts, and ports. - Maintain an explicit allowlist of configured board addresses rather than accepting arbitrary credential-bearing URLs.
- Reject URL user information, unexpected paths, fragments, and malformed hostnames.
- Ensure authorization headers are never forwarded across redirects to a different origin; preferably disable redirects for this API request.
- Avoid default credentials and require users to configure unique board passwords.
- Where the target hardware cannot support TLS, use a trusted local HTTPS gateway, an authenticated VPN, or an isolated management network.