T09 · Insecure Skill Coding Practices
Error
- Location
scripts/unifi-api.sh:33- Finding
TLS Certificate Verification Disabled for Authentication and API Requests
- Content
View full analysis
/dev/null ``` ```bash curl -sk -b "$UNIFI_COOKIE_FILE" "$full_url" ``` ### Technical Analysis Both `curl` commands use `-k`, which is equivalent to `--insecure`. This disables validation of the HTTPS certificate presented by the UniFi gateway. The authentication request sends the configured administrator username and password in its JSON body. Subsequent API requests transmit an authenticated session cookie. Although HTTPS encryption is requested, disabling certificate verification prevents the client from confirming that it is communicating with the intended gateway. An attacker capable of intercepting or redirecting local network traffic could present an attacker-controlled certificate. Because `curl -k` accepts that certificate, the attacker could terminate the TLS connection, read the authentication payload, capture the session cookie, and relay requests to the legitimate gateway to avoid obvious failures. ### Attack Path 1. The victim configures a legitimate UniFi gateway URL and invokes one of the Skill scripts. 2. An attacker obtains a suitable local interception position through a compromised access point, ARP spoofing, DNS poisoning, routing compromise, or another network redirection technique. 3. The attacker redirects the configured gateway connection to an attacker-controlled TLS endpoint. 4. The attacker presents an untrusted or forged certificate. 5. The script accepts the certificate because `curl` is invoked with `-k`. 6. The login request exposes the UniFi username and password to the attacker. 7. Authenticated API requests can additionally expose a reusable session cookie and sensitive network ...[truncated 676 chars]- Remediation
View remediation