T09 · Insecure Skill Coding Practices
Error
- Location
scripts/unifi-api.sh:40- Finding
TLS Certificate Verification Is Disabled for Authentication and API Requests
- Content
View full analysis
/dev/null ``` ```bash curl -sk -b "$UNIFI_COOKIE_FILE" "$full_url" ``` ### Technical Analysis The `-k` option instructs curl to accept an HTTPS server without validating its certificate. It is used for both the login request and every authenticated API request. Although traffic remains encrypted, the client does not verify that it is communicating with the intended UniFi gateway. An attacker with a suitable local network interception position can present an arbitrary certificate and impersonate the gateway. The login request transmits the configured username and password in its JSON body, while subsequent requests transmit the authenticated session cookie. The behavior is documented in `README.md:94-96`, but documentation does not mitigate the underlying loss of server authentication. ### Attack Path 1. The attacker gains a position capable of influencing local traffic, such as control over Wi-Fi, DNS, ARP resolution, routing, or another device on the local network. 2. The attacker redirects traffic intended for the configured UniFi host to a malicious HTTPS server. 3. The malicious server presents an untrusted or attacker-generated certificate. 4. Because curl is invoked with `-k`, the client accepts the certificate without warning. 5. During `/api/auth/login`, the attacker receives the configured username and password. 6. The attacker can attempt to authenticate to the real gateway using the captured credentials or return falsified API responses to the monitoring scripts. 7. Authenticated session cookies may also be captured from subsequent requests. ### Impact Assessment Successful exploitation can disclose t ...[truncated 449 chars]- Remediation
View remediation