T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/send_message.py:67
- Finding
- Board Credentials and Message Content Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `scripts/send_message.py`, lines 67-100 **Vulnerability Type**: Plaintext transmission of credentials and sensitive message data **Risk Level**: High ### Vulnerable Code ```python # Handle hostname vs IP (simple check, user must provide scheme or we assume http) if ip.startswith("http"): url = f"{ip}/api" else: url = f"http://{ip}/api" # Build payload payload = {"MSG": args.message} if args.repeat is not None: payload["REP"] = args.repeat if args.buzzer is not None: payload["BUZ"] = args.buzzer if args.delay is not None: payload["DEL"] = args.delay if args.brightness is not None: payload["BRI"] = args.brightness if args.chirp is not None: payload["ALERTCHIRP"] = args.chirp data = json.dumps(payload).encode('utf-8') # Setup request req = urllib.request.Request(url, data=data, method='POST') req.add_header('Content-Type', 'application/json') # Basic Auth auth_str = f"{user}:{password}" b64_auth = base64.b64encode(auth_str.encode('utf-8')).decode('utf-8') req.add_header('Authorization', f"Basic {b64_auth}") ``` ### Technical Analysis The script sends the board username, password, and message through an HTTP request. Base64 encoding is required by HTTP Basic Authentication, but it provides no confidentiality and can be trivially decoded. When the supplied destination does not begin with `http`, the script explicitly constructs a plaintext `http://` URL. It also accepts a caller-controlled URL through `--ip` without restricting the destination to approved board addresses or requiring HTTPS. Consequently, credentials loaded from environment variables or `boards.yaml` can be sent to a caller-selected endpoint. The network transmission itself is necessary for the Skill's declared message-board functionality. The use of plaintext HTTP and unrestricted destinations, however, does not follow least-trust principles and exposes more sensitive information ...[truncated 1234 chars]
- Remediation
- ## Remediation Suggestions - Require HTTPS for authenticated connections and retain standard TLS certificate and hostname validation. - Reject plaintext HTTP unless the user explicitly enables a documented legacy mode after receiving a security warning. - Parse destinations with `urllib.parse.urlsplit` and permit only approved schemes, hosts, and ports. - Maintain an explicit allowlist of configured board addresses rather than accepting arbitrary credential-bearing URLs. - Reject URL user information, unexpected paths, fragments, and malformed hostnames. - Ensure authorization headers are never forwarded across redirects to a different origin; preferably disable redirects for this API request. - Avoid default credentials and require users to configure unique board passwords. - Where the target hardware cannot support TLS, use a trusted local HTTPS gateway, an authenticated VPN, or an isolated management network.