T09 · Insecure Skill Coding Practices
Error
- Location
scripts/adguard.sh:8- Finding
Administrative Credentials and Session Data Transmitted over Plaintext HTTP
- Content
View full analysis
/dev/null) ``` ### Technical Analysis The default AdGuard URL uses unencrypted HTTP, and the documentation also presents HTTP as the normal configuration. The login request sends the administrator username and password in a JSON body over this connection. Subsequent privileged API requests transmit the session cookie over the same unencrypted channel. HTTP provides neither confidentiality nor integrity. An attacker with a suitable network position can inspect credentials and session cookies or modify API requests and responses. This is particularly relevant because AdGuard Home is commonly administered over a shared local network, where compromised clients, malicious access points, ARP spoofing, or improperly isolated guest devices may provide an interception position. ### Attack Path 1. The operator configures or accepts an `http://` AdGuard URL. 2. The operator invokes any command, such as `status`, `block`, or `toggle`. 3. The script sends the administrator password to `/control/login` over plaintext HTTP. 4. A network-positioned attacker captures the HTTP request or the returned session cookie. 5. The attacker reuses the credential or cookie to invoke privileged AdGuard Home API endpoints. 6. The attacker can alter DNS filtering policy, disab ...[truncated 525 chars]- Remediation
View remediation