T09 · Insecure Skill Coding Practices
- Location
xunlei_docker_client.js:22- Finding
Plaintext Communication with the Xunlei Service
- Content
View full analysis
Vulnerability Details
File Location:
xunlei_docker_client.js:22-27; insecure default configuration inconfig.json:1-5
Vulnerability Type: Cleartext transmission of sensitive API data
Risk Level: MediumVulnerable Code
js configure(host, port, ssl = false) { this.host = host; this.port = port; this.ssl = ssl; this.baseUrl = `${this.ssl ? 'https' : 'http'}://${host}:${port}`; }The bundled configuration explicitly disables TLS:
json { "host": "192.168.1.40", "port": 2345, "ssl": false }Technical Analysis
The connection configuration defaults
ssltofalse, causing API requests to use HTTP unless TLS is explicitly enabled. The bundledconfig.jsonalso selects this insecure mode.Subsequent requests transmit Xunlei authentication headers, device identifiers, task metadata, filenames, and magnet links over that connection. Plain HTTP provides neither confidentiality nor transport integrity. An attacker with a network position between the Skill host and the Xunlei service can inspect or alter this traffic.
Although the service appears intended for a local network, a LAN should not be treated as a trusted security boundary. Compromised endpoints, malicious wireless clients, ARP spoofing, or misconfigured network routing could provide the required interception position.
Attack Path
- The Skill loads
config.jsonand configures the service withssl: false. configure()constructs anhttp://192.168.1.40:2345base URL.- A user requests task status, submits a magnet link, or invokes another Xunlei operation.
- The Skill sends API requests, including the
pan-authheader and download data, over plaintext HTTP. - An attacker on the same network performs traffic capture, ARP spoofing, malicious gateway interception, or another man-in-the-middle technique.
- The attacker reads sensitive download information or modifies requests ...[truncated 710 chars]
- The Skill loads
- Remediation
View remediation
Remediation Suggestions
-
Change the default to require TLS:
js configure(host, port, ssl = true) { if (!ssl) { throw new Error('Plaintext HTTP connections are disabled'); } this.host = host; this.port = port; this.ssl = true; this.baseUrl = `https://${host}:${port}`; } -
Remove the environment-specific
config.jsonfrom the distributed package and provide only a sanitized example such asconfig.example.json. -
Require explicit administrative approval if legacy HTTP support is unavoidable.
-
Ensure Axios performs normal certificate validation; do not introduce an HTTPS agent that disables certificate verification.
-
Use a certificate whose subject matches the configured hostname. For private deployments, use an internal certificate authority and install only the required CA certificate.
-
Restrict network access to the Xunlei service with firewall rules and network segmentation.
-
Document that HTTP mode exposes authentication and download metadata and should only be used for isolated development environments.
-