T09 · Insecure Skill Coding Practices
Error
- Location
- email_sender.py:19
- Finding
- SMTP Authentication and Email Transmission May Occur Without Transport Encryption## Vulnerability Details **File Location**: `email_sender.py`, lines 19–20 **Vulnerability Type**: Conditional plaintext transmission of SMTP credentials and email contents **Risk Level**: High **Complete Code Snippet**: ```python server = smtplib.SMTP_SSL(config['server'], config['port']) if config.get('useTLS') else smtplib.SMTP(config['server'], config['port']) server.login(config['username'], config['password']) ``` ### Technical Analysis The SMTP connection is encrypted only when the `useTLS` configuration value evaluates to true. If that setting is false, missing, or otherwise falsey, the code creates a plaintext `smtplib.SMTP` connection and immediately calls `server.login()` without first negotiating STARTTLS. As a result, SMTP authentication credentials and subsequently transmitted message data may be exposed over the network. Although some authentication mechanisms encode credentials, encoding does not provide confidentiality. The implementation also does not create an explicit verified TLS context or reject configurations that disable transport encryption. ### Attack Path 1. The SMTP configuration omits `useTLS` or sets it to `false`. 2. The skill opens a plaintext SMTP connection using `smtplib.SMTP`. 3. It authenticates through `server.login()` without calling `starttls()`. 4. An attacker with a network position between the host and SMTP server captures or manipulates the SMTP traffic. 5. The attacker may recover SMTP credentials and observe email bodies or attachments. 6. Stolen credentials may then be used against the SMTP service within the permissions assigned to that account. ### Impact Assessment A successful network interception may disclose the configured SMTP username and password, email recipients, subjects, message contents, and attachments. Depending on the SMTP account's permissions, stolen credentials could permit unauthorized email transmission, impersonation of the configured sender, sp ...[truncated 268 chars]
- Remediation
- ## Remediation Suggestions - Require encrypted SMTP transport rather than silently falling back to plaintext. - For implicit TLS, use `smtplib.SMTP_SSL` with `ssl.create_default_context()`. - For explicit TLS, connect with `smtplib.SMTP`, issue `EHLO`, call `starttls(context=ssl.create_default_context())`, issue `EHLO` again, and only then call `login()`. - Reject missing or false TLS settings by default. If plaintext SMTP must be supported for an exceptional local environment, require an explicit insecure opt-in and display a prominent warning. - Validate the SMTP hostname and rely on certificate verification provided by a secure default SSL context. - Use a context manager or `try/finally` block to ensure the SMTP connection is closed safely on authentication, attachment-processing, or transmission failures. - Protect the configuration file with restrictive permissions and use a dedicated, least-privileged SMTP credential that is not reused by other services.