T09 · Insecure Skill Coding Practices
Error
- Location
- cli.js:20
- Finding
- IMAP TLS Certificate Validation Is Disabled<![CDATA[ ## Vulnerability Details **File Location**: `cli.js:20-29`; `download-attachments.js:14-23` **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code ```js function createImap(config) { return new imap({ user: config.email, password: config.password, host: config.host, port: config.port, tls: config.tls, tlsOptions: { rejectUnauthorized: false } }); } ``` ```js const imapConn = new imap({ user: config.email, password: config.password, host: config.host, port: config.port, tls: config.tls, tlsOptions: { rejectUnauthorized: false } }); ``` ### Technical Analysis Both IMAP connection implementations explicitly set `rejectUnauthorized` to `false`. When TLS is enabled, this instructs the client to accept certificates that are expired, self-signed, issued for another hostname, or signed by an untrusted authority. Consequently, TLS encryption does not provide reliable server authentication. An attacker capable of intercepting or redirecting network traffic can present an attacker-controlled certificate without causing the client to reject the connection. ### Attack Path 1. The victim invokes a mailbox command while connected through a network controlled or observed by the attacker. 2. The attacker intercepts or redirects the connection to the configured IMAP host. 3. The attacker presents a forged or otherwise invalid TLS certificate. 4. The client accepts the certificate because certificate validation is disabled. 5. The client supplies the configured email address and password to the impersonated IMAP endpoint. 6. The attacker can capture credentials and proxy, inspect, or manipulate mailbox traffic. ### Impact Assessment A successful attack can expose the mailbox username and password and compromise the confidentiality and integrity of retrieved email data. The attacker may obtain the same mailbox access permitted by the stolen credentials, including reading messages ...[truncated 301 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the `tlsOptions: { rejectUnauthorized: false }` setting or explicitly set `rejectUnauthorized: true`. - Require TLS for credential-bearing IMAP connections unless an explicitly documented legacy mode is necessary. - For private IMAP infrastructure, accept a configured trusted CA certificate rather than disabling verification globally. - Validate that the certificate hostname matches `config.host`. - Fail closed when certificate validation fails, and provide an actionable error rather than silently weakening transport security. - Rotate mailbox credentials after deploying the correction if the application has previously been used on untrusted networks. ]]>