T09 · Insecure Skill Coding Practices
- Location
scripts/add-to-dataset.sh:17- Finding
Bearer API Key Exposed by Disabled TLS Certificate Verification
- Content
View full analysis
Vulnerability Details
File Location:
scripts/add-to-dataset.sh:17-18, 52, 76-77
Vulnerability Type: Improper TLS certificate validation
Risk Level: HighVulnerable Code
bash AUTH_HEADER="Authorization: Bearer $KEY" CURL_OPTS="-s -S" [[ "$BASE" == https://* ]] && CURL_OPTS="$CURL_OPTS -k"The insecure options are subsequently used for authenticated requests:
bash RESP=$(curl $CURL_OPTS -H "$AUTH_HEADER" "$BASE/api/protected/data/folders?limit=100")bash RES=$(curl $CURL_OPTS -w "\n%{http_code}" -X POST -H "$AUTH_HEADER" -H "Content-Type: application/json" \ -d "$PAYLOAD" "$BASE/api/protected/data/folders/$FOLDER_ID/items")Technical Analysis
The script adds curl's
-koption whenever the configured base URL begins withhttps://. This option disables server-certificate and hostname verification for every HTTPS destination, including production servers.The bearer API key is then transmitted through this unverified connection. Encryption without certificate authentication does not establish that the remote endpoint is the intended SmartSaaS server. An attacker capable of intercepting or redirecting traffic can present an arbitrary certificate, terminate TLS, and receive both the bearer credential and request content.
This behavior is unnecessary for the declared production API functionality. Other scripts limit insecure TLS handling to localhost-like destinations, whereas this script disables verification for all HTTPS hosts.
Attack Path
- A user or agent invokes
add-to-dataset.shwith validSMARTSAAS_BASE_URLandSMARTSAAS_API_KEYenvironment variables. - An attacker obtains a network interception or redirection position, such as through a malicious proxy, compromised DNS, hostile Wi-Fi, or routing manipulation.
- The attacker presents an untrusted certificate while impersonating the configured HTTPS endpoint.
- Because curl runs with
-k, the script accepts the certificate without valida ...[truncated 1019 chars]
- A user or agent invokes
- Remediation
View remediation
Remediation Suggestions
- Remove unconditional use of curl's
-koption:
bash CURL_OPTS=(-sS)- Require a valid HTTPS URL for non-loopback destinations and reject plaintext HTTP.
- If local development genuinely requires a self-signed certificate, allow the exception only for strictly parsed loopback hostnames or addresses, not substring matches.
- Prefer configuring curl with an explicit development CA certificate:
bash curl --cacert "$SMARTSAAS_CA_BUNDLE" ...- Use Bash arrays for curl options so arguments remain correctly separated.
- Add automated tests confirming that production HTTPS requests fail for expired, self-signed, hostname-mismatched, and otherwise untrusted certificates.
- Rotate the API key if this script has been used over a network where interception may have occurred.
- Remove unconditional use of curl's