T09 · Insecure Skill Coding Practices
Error
- Location
rustchain_mcp/server.py:53- Finding
Disabled TLS Certificate Verification in MCP Network Client
- Content
View full analysis
httpx.Client: global _client if _client is None: _client = httpx.Client(timeout=RUSTCHAIN_TIMEOUT, verify=False) return _client ``` This shared client is subsequently used for sensitive calls, including: ```python r = get_client().post( f"{BEACON_URL}/relay/message", json=envelope, headers={"Authorization": f"Bearer {relay_token}"}, ) ``` ### Technical Analysis Setting `verify=False` disables HTTPS certificate-chain and hostname validation for every request made through the shared MCP client. Encryption without peer authentication does not establish that the client is communicating with the intended RustChain, BoTTube, or Beacon server. The affected request surface includes: - BoTTube API keys used for uploads, comments, and votes. - Beacon relay tokens used for heartbeats and messages. - Beacon administrative keys used for gas deposits. - Private agent message content. - Wallet addresses, signatures, public keys, memos, and transaction metadata. - Agent registration details and webhook URLs. The remote operations themselves are consistent with the Skill's declared functionality. However, disabling certificate verification is not necessary for those operations and weakens the security boundary protecting all transmitted credentials and data. ### Attack Path 1. An attacker obtains a network interception position, such as control of an untrusted Wi-Fi access point, proxy, compromised router, or DNS/network route. 2. The attacker intercepts a connection to a configured RustChain, BoTTube, or Beacon endpoint. 3. The attacker presents an arbitrary or self-signed TLS certificate. 4. Because the client uses `verify=False`, the certificate is accepted wi ...[truncated 1024 chars]- Remediation
View remediation
httpx.Client: global _client if _client is None: _client = httpx.Client(timeout=RUSTCHAIN_TIMEOUT) return _client ``` 2. Replace the default IP-address endpoint with a trusted hostname whose certificate contains the matching DNS name. 3. If a private certificate authority is required, configure an explicit CA bundle: ```python _client = httpx.Client( timeout=RUSTCHAIN_TIMEOUT, verify="/path/to/trusted-ca.pem", ) ``` 4. Reject plaintext `http://` endpoints for requests that carry credentials or financial data. 5. Consider an allowlist for production endpoints, especially for calls using relay tokens or administrative keys. 6. Use short-lived, narrowly scoped credentials and provide token revocation and rotation procedures. 7. Add automated tests asserting that certificate errors are not ignored. ]]>