T09 · Insecure Skill Coding Practices
- Location
src/auth.py:146- Finding
Plaintext Remote Authentication Callback Exposes Account Exchange Credentials
- Content
View full analysis
Vulnerability Details
File Location:
src/auth.py:146-161
Related Documentation:README.md:232-238
Vulnerability Type: Plaintext transmission of authentication material
Risk Level: MediumVulnerable Code
python parsed = urlparse(configured_callback) if parsed.scheme not in {"http", "https"} or not parsed.hostname: raise ValueError( "CYBERLENS_CONNECT_CALLBACK_URL must be a valid http:// or https:// URL." ) callback_path = parsed.path or "/callback" callback_url = parsed._replace(path=callback_path).geturl() bind_port_value = os.environ.get("CYBERLENS_CONNECT_BIND_PORT", "").strip() if bind_port_value: bind_port = int(bind_port_value) elif parsed.port is not None: bind_port = parsed.port else: raise ValueError( "Configured callback URLs must include a port or set " "CYBERLENS_CONNECT_BIND_PORT explicitly." ) bind_host = os.environ.get("CYBERLENS_CONNECT_BIND_HOST", "").strip() if not bind_host: bind_host = "127.0.0.1" if _is_loopback_host(parsed.hostname) else "0.0.0.0"The documented remote-installation workflow explicitly permits this configuration:
bash # Direct LAN or VPN callback export CYBERLENS_CONNECT_CALLBACK_URL="http://10.0.0.5:54321/callback"Technical Analysis
The authentication callback transports the OAuth-like
state, one-time connectioncode, andexchangeURL to the callback server. The implementation accepts both HTTP and HTTPS callback URLs regardless of whether the callback hostname is loopback or remote.HTTP is appropriate for a callback restricted to the local loopback interface because traffic does not normally leave the host. For a non-loopback callback, however, authentication parameters cross a LAN, VPN, proxy path, or other network without transport encryption.
The random state value protects against unsolicited callback injection, but it does not protect against an attacker who can observe the legitimate plaintext callback ...[truncated 1245 chars]
- Remediation
View remediation
Remediation Suggestions
- Permit
http://callbacks only when the callback hostname is a loopback address such aslocalhost,127.0.0.1, or::1. - Require
https://for every non-loopback callback URL. - Reject configurations where a remote callback uses HTTP, even if the user explicitly supplies a bind address.
- Update the remote-installation documentation to use an HTTPS reverse proxy, authenticated tunnel, or equivalent encrypted channel.
- Consider binding externally reachable callback listeners only after an explicit secure configuration check.
- Preserve the existing random state validation and one-time exchange-code semantics as defense-in-depth.
- Permit